5.3

CVE-2021-35525

EPSS 0.61%
Published 28.06.2021 18:15:08
Last modified 21.11.2024 06:12:26
Source cve@mitre.org
CVE-Watchlists
Login
Open
Login

PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated email addresses. NOTE: the PostSRSd maintainer acknowledges "theoretically, this error should never occur ... I'm not sure if there's a reliable way to trigger this condition by an external attacker, but it is a security bug in PostSRSd nevertheless."

Affected products Warnungen 0 Metrics 3 CWE 0 References 7

Data is provided by the National Vulnerability Database (NVD)

Postsrsd Project ≫ Postsrsd Version < 1.11

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.61%	0.69

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:N/A:P

https://security.gentoo.org/glsa/202107-08

Third Party Advisory

https://bugs.gentoo.org/793674

Patch

Third Party Advisory

Release Notes

Issue Tracking

https://github.com/roehling/postsrsd/commit/077be98d8c8a9847e4ae0c7dc09e7474cbe27db2

Patch

Third Party Advisory

https://github.com/roehling/postsrsd/releases/tag/1.11

Third Party Advisory

Release Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-35525

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-35525

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-35525

EUVD