CVE-2020-35679

smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 81%
VendorProductVersion
opensmtpdopensmtpd
𝑥
< 6.8.0
opensmtpdopensmtpd
6.8.0
opensmtpdopensmtpd
6.8.0:patch1-rc1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
opensmtpd
bullseye
6.8.0p2-3
fixed
buster
no-dsa
stretch
not-affected
bookworm
6.8.0p2-4
fixed
sid
7.5.0p0-1
fixed
trixie
7.5.0p0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
opensmtpd
noble
needed
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needed
impish
ignored
hirsute
ignored
groovy
ignored
focal
needed
bionic
not-affected
xenial
not-affected
trusty
needs-triage
Common Weakness Enumeration
References
https://github.com/openbsd/src/commit/79a034b4aed29e965f45a13409268290c9910043
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LKTFBQCHGMVPR4IZWHQIYAPM5J3LN3J/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TYAYXRV2DM5K4RU7RHCDZSA2UF6VCTRC/
https://poolp.org/posts/2020-12-24/december-2020-opensmtpd-6.8.0p1-released-fixed-several-bugs-proposed-several-diffs-book-is-on-github/
https://security.gentoo.org/glsa/202105-12
https://www.mail-archive.com/misc%40opensmtpd.org/msg05188.html
https://github.com/openbsd/src/commit/79a034b4aed29e965f45a13409268290c9910043
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LKTFBQCHGMVPR4IZWHQIYAPM5J3LN3J/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TYAYXRV2DM5K4RU7RHCDZSA2UF6VCTRC/
https://poolp.org/posts/2020-12-24/december-2020-opensmtpd-6.8.0p1-released-fixed-several-bugs-proposed-several-diffs-book-is-on-github/
https://security.gentoo.org/glsa/202105-12
https://www.mail-archive.com/misc%40opensmtpd.org/msg05188.html