libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of incorrect sprintf usage in SPF_record_expand_data in spf_expand.c. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g., with additional configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not.
References
Link | Resource |
---|---|
https://github.com/shevek/libspf2/tree/8131fe140704eaae695e76b5cd09e39bd1dd220b | Third Party Advisory |
https://lists.debian.org/debian-lts-announce/2022/01/msg00015.html | Mailing List Third Party Advisory |
https://nathanielbennett.com/blog/libspf2-cve-jan-2022-disclosure | Exploit Third Party Advisory |
https://security.gentoo.org/glsa/202401-22 |
Configurations
History
15 Jan 2024, 17:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
26 Jan 2022, 17:36
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 9.3
v3 : 9.8 |
First Time |
Debian debian Linux
Debian Libspf2 Project libspf2 Libspf2 Project |
|
CWE | CWE-787 | |
CPE | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:a:libspf2_project:libspf2:*:*:*:*:*:*:*:* |
|
References | (MLIST) https://lists.debian.org/debian-lts-announce/2022/01/msg00015.html - Mailing List, Third Party Advisory | |
References | (MISC) https://nathanielbennett.com/blog/libspf2-cve-jan-2022-disclosure - Exploit, Third Party Advisory | |
References | (MISC) https://github.com/shevek/libspf2/tree/8131fe140704eaae695e76b5cd09e39bd1dd220b - Third Party Advisory |
21 Jan 2022, 03:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
19 Jan 2022, 18:25
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-01-19 18:15
Updated : 2024-01-15 17:15
NVD link : CVE-2021-33912
Mitre link : CVE-2021-33912
CVE.ORG link : CVE-2021-33912
JSON object : View
Products Affected
libspf2_project
- libspf2
debian
- debian_linux
CWE
CWE-787
Out-of-bounds Write