Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2020-7247 →
DEBIAN-CVE-2020-7247
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
opensmtpd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-1"}]}]
Debian:13
opensmtpd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-1"}]}]
Debian:14
opensmtpd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-1"}]}]
Références
- advisory security-tracker.debian.org