CVE-2020-8793

MEDIUM 4.7CVE-2020-8793 · Published 25/02/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
opensmtpd opensmtpd	`< 6.6.4`	`6.6.4`

Description

OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.

References

seclists.org/fulldisclosure/2020/Feb/28 · Mailing List
openwall.com/lists/oss-security/2020/02/24/4 · Exploit
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E
usn.ubuntu.com/4294-1 · Third Party Advisory
openbsd.org/security.html · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free