Vulnerabilities > CVE-2020-35680 - NULL Pointer Dereference vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

opensmtpd

fedoraproject

CWE-476

NVD

Published: 2020-12-24

Updated: 2023-11-07

Summary

smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client activity, because the filter state machine does not properly maintain the I/O channel between the SMTP engine and the filters layer.

Vulnerable Configurations

Part	Description	Count
Application	Opensmtpd Opensmtpd Opensmtpd 6.8.0 Opensmtpd Opensmtpd 5.0 Opensmtpd Opensmtpd 5.2.1 Opensmtpd Opensmtpd 5.3 Opensmtpd Opensmtpd 5.3.1 Opensmtpd Opensmtpd 5.3.2 Opensmtpd Opensmtpd 5.3.3 Opensmtpd Opensmtpd 5.4 Opensmtpd Opensmtpd 5.4.1 Opensmtpd Opensmtpd 5.4.2 Opensmtpd Opensmtpd 5.4.4 Opensmtpd Opensmtpd 5.4.5 Opensmtpd Opensmtpd 5.4.6 Opensmtpd Opensmtpd 5.4.6-2 Opensmtpd Opensmtpd 5.7.1 Opensmtpd Opensmtpd 5.7.2 Opensmtpd Opensmtpd 5.7.3 Opensmtpd Opensmtpd 5.9.1 Opensmtpd Opensmtpd 5.9.2 Opensmtpd Opensmtpd 6.0.0 Opensmtpd Opensmtpd 6.0.2 Opensmtpd Opensmtpd 6.0.3 Opensmtpd Opensmtpd 6.4.0 Opensmtpd Opensmtpd 6.4.1 Opensmtpd Opensmtpd 6.4.2 Opensmtpd Opensmtpd 6.6.0 Opensmtpd Opensmtpd 6.6.1 Opensmtpd Opensmtpd 6.6.2 Opensmtpd Opensmtpd 6.6.3 Opensmtpd Opensmtpd 6.6.4 Opensmtpd Opensmtpd 6.7.1	61
OS	Fedoraproject Fedoraproject Fedora 32 Fedoraproject Fedora 33	2

Common Weakness Enumeration (CWE)

CWE-476 - NULL Pointer Dereference

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References