CVE-2020-35680
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client activity, because the filter state machine does not properly maintain the I/O channel between the SMTP engine and the filters layer.
El archivo smtpd/lka_filter.c en OpenSMTPD versiones anteriores a 6.8.0p1, en determinadas configuraciones, permite a atacantes remotos causar una denegación de servicio (desreferencia del puntero NULL y fallo del demonio) por medio de un patrón diseñado de actividad del cliente, porque la máquina de estado del filtro no mantiene apropiadamente el canal de I/O entre el motor SMTP y la capa de filtros
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-12-24 CVE Reserved
- 2020-12-24 CVE Published
- 2024-08-04 CVE Updated
- 2024-11-14 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-476: NULL Pointer Dereference
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| https://poolp.org/posts/2020-12-24/december-2020-opensmtpd-6.8.0p1-released-fixed-several-bugs-proposed-several-diffs-book-is-on-github | Third Party Advisory | |
| https://www.mail-archive.com/misc%40opensmtpd.org/msg05188.html | X_refsource_misc |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/openbsd/src/commit/6c3220444ed06b5796dedfd53a0f4becd903c0d1 | 2023-11-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Opensmtpd Search vendor "Opensmtpd" | Opensmtpd Search vendor "Opensmtpd" for product "Opensmtpd" | < 6.8.0 Search vendor "Opensmtpd" for product "Opensmtpd" and version " < 6.8.0" | - |
Affected
| ||||||
| Opensmtpd Search vendor "Opensmtpd" | Opensmtpd Search vendor "Opensmtpd" for product "Opensmtpd" | 6.8.0 Search vendor "Opensmtpd" for product "Opensmtpd" and version "6.8.0" | - |
Affected
| ||||||
| Opensmtpd Search vendor "Opensmtpd" | Opensmtpd Search vendor "Opensmtpd" for product "Opensmtpd" | 6.8.0 Search vendor "Opensmtpd" for product "Opensmtpd" and version "6.8.0" | patch1-rc1 |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 32 Search vendor "Fedoraproject" for product "Fedora" and version "32" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 33 Search vendor "Fedoraproject" for product "Fedora" and version "33" | - |
Affected
| ||||||