CVE-2021-35525

Medium

Description

PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated email addresses. NOTE: the PostSRSd maintainer acknowledges "theoretically, this error should never occur ... I'm not sure if there's a reliable way to trigger this condition by an external attacker, but it is a security bug in PostSRSd nevertheless."

SeverityMedium

CVSS5.3

Exploit probability—

ProductPostsrsd

PublishedJun 28, 2021

First seenJun 28, 2021

How to fix

Update

postsrsd_project postsrsd1.11 or later

Vendor advisories

security.gentoo.org/glsa/202107-08

Affected products

Product	Affected versions	Fixed in
postsrsd_project postsrsd	v < 1.11	1.11

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.