Remote Code Execution Vulnerability in OpenSMTPD by OpenBSD
CVE-2023-29323

7.8HIGH

Key Information:

Vendor

OpenBSD
Status
OpenBSD
Opensmtpd
Vendor
CVE Published:
4 April 2023

What is CVE-2023-29323?

A flaw in the ascii_load_sockaddr function within smtpd of OpenBSD and OpenSMTPD allows for an abort when processing a connection from a local, scoped IPv6 address, potentially leading to service disruptions. This vulnerability requires immediate attention to ensure service reliability and security integrity.

References

https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/02...
https://ftp.openbsd.org/pub/OpenBSD/patches/7.1/common/02...
https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/sm...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-29323 : Remote Code Execution Vulnerability in OpenSMTPD by OpenBSD