Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1063285

Bug#990439: postsrsd: CVE-2021-35525

Show all headers | View raw

Source: postsrsd
Version: 1.10-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for postsrsd.

CVE-2021-35525[0]:
| PostSRSd before 1.11 allows a denial of service (subprocess hang) if
| Postfix sends certain long data fields such as multiple concatenated
| email addresses. NOTE: the PostSRSd maintainer acknowledges
| "theoretically, this error should never occur ... I'm not sure if
| there's a reliable way to trigger this condition by an external
| attacker, but it is a security bug in PostSRSd nevertheless."


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-35525
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35525
[1] https://github.com/roehling/postsrsd/commit/077be98d8c8a9847e4ae0c7dc09e7474cbe27db2

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#990439: postsrsd: CVE-2021-35525 Salvatore Bonaccorso <carnil@debian.org> - 2021-06-29 07:50 +0200
  Bug#990439: postsrsd: CVE-2021-35525 Oxan van Leeuwen <oxan@oxanvanleeuwen.nl> - 2021-07-05 18:20 +0200
    Bug#990439: postsrsd: CVE-2021-35525 Salvatore Bonaccorso <carnil@debian.org> - 2021-07-05 22:00 +0200
      Bug#990439: postsrsd: CVE-2021-35525 Oxan van Leeuwen <oxan@oxanvanleeuwen.nl> - 2021-07-14 22:10 +0200
        Bug#990439: postsrsd: CVE-2021-35525 Salvatore Bonaccorso <carnil@debian.org> - 2021-07-15 22:10 +0200

csiph-web