USN-4268-1: OpenSMTPD vulnerability
It was discovered that OpenSMTPD incorrectly verified the sender's or receiver's e-mail addresses under certain conditions. An attacker could use this vulnerability to execute arbitrary commands as root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/opensmtpdto a version that resolves this vulnerability.Fixed in 6.0.3p1-6ubuntu0.1 - Upgrade
Upgrade
ubuntu/opensmtpdto a version that resolves this vulnerability.Fixed in 6.0.3p1-1ubuntu0.1
Event History
Frequently Asked Questions
What is the vulnerability ID for this OpenSMTPD vulnerability?
The vulnerability ID for this OpenSMTPD vulnerability is USN-4268-1.
How does the vulnerability in OpenSMTPD affect the system?
The vulnerability allows an attacker to execute arbitrary commands as root.
Which versions of OpenSMTPD are affected by this vulnerability?
Versions 6.0.3p1-6ubuntu0.1 and 6.0.3p1-1ubuntu0.1 of OpenSMTPD are affected.
How can I fix the OpenSMTPD vulnerability?
To fix the vulnerability, update OpenSMTPD to version 6.0.3p1-6ubuntu0.1 or 6.0.3p1-1ubuntu0.1, depending on your Ubuntu version.
Where can I find more information about this OpenSMTPD vulnerability?
You can find more information about this OpenSMTPD vulnerability on the Ubuntu security advisory page: https://ubuntu.com/security/CVE-2020-7247