CVE-2013-2125 OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blocking) by keeping a connection open.
MediumCVSS 5.0
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blocking) by keeping a connection open.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/opensmtpd(Debian:12) | < 5.3.3p1-1 | 5.3.3p1-1 |
| debian/opensmtpd(Debian:13) | < 5.3.3p1-1 | 5.3.3p1-1 |
| debian/opensmtpd(Debian:14) | < 5.3.3p1-1 | 5.3.3p1-1 |
| OpenBSD opensmtpd | <= 5.3.1 | No fix listed |
References
- Debian Security Tracker CVE-2013-2125 vendor-advisory
- git.zx2c4.com exploit patch
- 93495 vdb-entry
- [oss-security] 20130518 CVE Request: DoS in OpenSMTPD TLS Support exploit mailing-list
- [oss-security] 20130518 Re: Re: CVE Request: DoS in OpenSMTPD TLS Support mailing-list
- 53353 third-party-advisory
- opensmtpd-cve20132125-dos(84388) vdb-entry