CVE-2021-33912

Katalog CVE

CVSS 9.8 · Critical EPSS 9,6%

Kerentanan Out-of-bounds Write pada libspf2 project libspf2, debian linux. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of incorrect sprintf usage in SPF_record_expand_data in spf_expand.c. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g., with additional configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not.

Rincian

Terbit di NVD

19 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

9,6% peluang dieksploitasi; lebih tinggi dari 95,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/shevek/libspf2/tree/8131fe140704eaae695e76b5cd09e39bd1dd220b advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/01/msg00015.html mailing list · advisory pihak ketiga
• https://nathanielbennett.com/blog/libspf2-cve-jan-2022-disclosure exploit · advisory pihak ketiga
• https://security.gentoo.org/glsa/202401-22