vulnerability

Ubuntu: (Multiple Advisories) (CVE-2020-7247): OpenSMTPD vulnerability

Try Surface Command
Back to search
Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
Jan 29, 2020
Added
Feb 6, 2020
Modified
Apr 16, 2026

Description

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

Solutions

ubuntu-pro-upgrade-opensmtpdubuntu-upgrade-opensmtpd

References

Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report