Vulnerabilities > CVE-2020-35679 - Memory Leak vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

opensmtpd

fedoraproject

CWE-401

NVD

Published: 2020-12-24

Updated: 2024-11-21

Summary

smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups.

Vulnerable Configurations

Part	Description	Count
Application	Opensmtpd Opensmtpd Opensmtpd 6.8.0 Opensmtpd Opensmtpd 5.0 Opensmtpd Opensmtpd 5.2.1 Opensmtpd Opensmtpd 5.3 Opensmtpd Opensmtpd 5.3.1 Opensmtpd Opensmtpd 5.3.2 Opensmtpd Opensmtpd 5.3.3 Opensmtpd Opensmtpd 5.4 Opensmtpd Opensmtpd 5.4.1 Opensmtpd Opensmtpd 5.4.2 Opensmtpd Opensmtpd 5.4.4 Opensmtpd Opensmtpd 5.4.5 Opensmtpd Opensmtpd 5.4.6 Opensmtpd Opensmtpd 5.4.6-2 Opensmtpd Opensmtpd 5.7.1 Opensmtpd Opensmtpd 5.7.2 Opensmtpd Opensmtpd 5.7.3 Opensmtpd Opensmtpd 5.9.1 Opensmtpd Opensmtpd 5.9.2 Opensmtpd Opensmtpd 6.0.0 Opensmtpd Opensmtpd 6.0.2 Opensmtpd Opensmtpd 6.0.3 Opensmtpd Opensmtpd 6.4.0 Opensmtpd Opensmtpd 6.4.1 Opensmtpd Opensmtpd 6.4.2 Opensmtpd Opensmtpd 6.6.0 Opensmtpd Opensmtpd 6.6.1 Opensmtpd Opensmtpd 6.6.2 Opensmtpd Opensmtpd 6.6.3 Opensmtpd Opensmtpd 6.6.4 Opensmtpd Opensmtpd 6.7.1	61
OS	Fedoraproject Fedoraproject Fedora 32 Fedoraproject Fedora 33	2

Common Weakness Enumeration (CWE)

CWE-401 - Improper Release of Memory Before Removing Last Reference ('Memory Leak')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References