CVE-2020-8794

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-8794
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8794.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-8794
Downstream
Published
2020-02-25T17:15:13.197Z
Modified
2026-04-11T17:01:36.569765Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mtaio in mtasession.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.

References

Affected packages

Git / github.com/opensmtpd/opensmtpd

Affected ranges

Type
GIT
Repo
https://github.com/opensmtpd/opensmtpd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
555d2121736acdd70453b24b94c8c2996d9ab5f9
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.6.4"
        }
    ]
}

Affected versions

6.*
6.6.1p1
6.6.2p1
6.6.3p1
Other
l
opensmtpd-20121030111957p1
opensmtpd-20121106111009p1
opensmtpd-20121107175757p1
opensmtpd-20121113231010p1
opensmtpd-201211152324p1
opensmtpd-201211232348p1
opensmtpd-201211261224p1
opensmtpd-201212031111p1
opensmtpd-201212081318p1
opensmtpd-201212222206p1
opensmtpd-201301031733p1
opensmtpd-201301111154p1
opensmtpd-201301191220p1
opensmtpd-201301241740p1
opensmtpd-201301252211p1
opensmtpd-201301281310p1
opensmtpd-201302051638p1
opensmtpd-201302141353p1
opensmtpd-201302152354p1
opensmtpd-201302212015p1
opensmtpd-201303011853p1
opensmtpd-201303201252p1
opensmtpd-201303211343p1
opensmtpd-201303221610p1
opensmtpd-201303311750p1
opensmtpd-201304041639p1
opensmtpd-201305171925p1
opensmtpd-201305171950p1
opensmtpd-201305241932p1
opensmtpd-201306071637p1
opensmtpd-201306211627p1
opensmtpd-201306271531p1
opensmtpd-201307091512p1
opensmtpd-201307121003p1
opensmtpd-201307151923p1
opensmtpd-201307191003p1
opensmtpd-201307191119p1
opensmtpd-201307221453p1
opensmtpd-201307290744p1
opensmtpd-201309091202p1
opensmtpd-201309121848p1
opensmtpd-201309121931p1
opensmtpd-201309201537p1
opensmtpd-201309241457p1
opensmtpd-201309241712p1
opensmtpd-201309241818p1
opensmtpd-201309251624p1
opensmtpd-201309261726p1
opensmtpd-201310081839p1
opensmtpd-201310101759p1
opensmtpd-201310231634p1
opensmtpd-201310241356p1
opensmtpd-201310251946p1
opensmtpd-201310281424p1
opensmtpd-201311071830p1
opensmtpd-201311181634p1
opensmtpd-201311182347p1
opensmtpd-201311201707p1
opensmtpd-201311261029p1
opensmtpd-201311270853p1
opensmtpd-201311281211p1
opensmtpd-201311292259p1
opensmtpd-201312021552p1
opensmtpd-201312021558p1
opensmtpd-201312081717p1
opensmtpd-201312131550p1
opensmtpd-201312142054p1
opensmtpd-201401061555p1
opensmtpd-201401201010p1
opensmtpd-201401201614p1
opensmtpd-201401202159p1
opensmtpd-201401231518p1
opensmtpd-201401241552p1
opensmtpd-201404151432p1
opensmtpd-201405071644p1
opensmtpd-201405121644p1
opensmtpd-201405121707p1
opensmtpd-201405142229p1
opensmtpd-201405142325p1
opensmtpd-201405202105p1
opensmtpd-201406061833p1
opensmtpd-201406170940p1
opensmtpd-201406190036p1
opensmtpd-201406192219p1
opensmtpd-201406192306p1
opensmtpd-201410012105p1
opensmtpd-201410040019p1
opensmtpd-201410131657p1
opensmtpd-201410152136p1
opensmtpd-201411042328p1
opensmtpd-201411052125p1
opensmtpd-201412241507p1
opensmtpd-201501060207p1
opensmtpd-201502012312p1
opensmtpd-201505091607p1
opensmtpd-201505121836p1
opensmtpd-201505241924p1
opensmtpd-201506020910p1
opensmtpd-201506112227p1
opensmtpd-201601051911p1
opensmtpd-201602031446p1
opensmtpd-201602120826p1
opensmtpd-201602131612p1
opensmtpd-201602131907p1
opensmtpd-201605221711p1
opensmtpd-201606062256p1
opensmtpd-201606062303p1
opensmtpd-201606071034p1
opensmtpd-201606152203p1
opensmtpd-201606220754p1
opensmtpd-201609141253p1
opensmtpd-201702130941p1
opensmtpd-201801101420p1
opensmtpd-5.*
opensmtpd-5.0p1
opensmtpd-5.2.1p1
opensmtpd-5.3p1
opensmtpd-5.4.2p1
opensmtpd-5.9.1p1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8794.json"
vanir_signatures_modified 
"2026-04-11T17:01:36Z"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "19.10"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "31"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "32"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    }
]
vanir_signatures 
[
    {
        "source": "https://github.com/opensmtpd/opensmtpd/commit/555d2121736acdd70453b24b94c8c2996d9ab5f9",
        "signature_type": "Function",
        "id": "CVE-2020-8794-7da4040d",
        "target": {
            "function": "queue_fs_envelope_create",
            "file": "smtpd/queue_fs.c"
        },
        "digest": {
            "length": 852.0,
            "function_hash": "196875953881991152077236116624259068501"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "source": "https://github.com/opensmtpd/opensmtpd/commit/555d2121736acdd70453b24b94c8c2996d9ab5f9",
        "signature_type": "Line",
        "id": "CVE-2020-8794-8fca902c",
        "target": {
            "file": "smtpd/queue_fs.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "242575823212615086944252627364996250139",
                "191066550062516158912985716223257094754",
                "166787329513173112996708886338970170939",
                "256753418468187729585530898156176574718",
                "273979709428202467439049274088971250784"
            ]
        },
        "signature_version": "v1",
        "deprecated": false
    }
]