CVE-2021-33912

Description

libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of incorrect sprintf usage in SPF_record_expand_data in spf_expand.c. The vulnerable code may be part of the supply chain of a sites e-mail infrastructure (e.g., with additional configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

1.35

Associated Vulnerability

Vulnerability	OS Platform
Sender Policy Framework for SMTP authorization (USN-6584-1) spfquery_1.2.10-7+deb9u2build0.20.04.1_amd64.deb	Linux
Sender Policy Framework for SMTP authorization (USN-6584-1) libspf2-2_1.2.10-7+deb9u2build0.20.04.1_amd64.deb	Linux
Sender Policy Framework for SMTP authorization (USN-6584-1) libspf2-dev_1.2.10-7+deb9u2build0.20.04.1_amd64.deb	Linux
Sender Policy Framework for SMTP authorization (USN-6584-1) libmail-spf-xs-perl_1.2.10-7+deb9u2build0.20.04.1_amd64.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234