{"id":"CVE-2013-2125","aliases":["DEBIAN-CVE-2013-2125","EUVD-2013-2093","GHSA-63q3-5f3r-v5j4"],"status":"published","title":"OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to...","description":"OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blocking) by keeping a connection open.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02474,"percentile":0.84649,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2014-05-27T14:55:09Z","modified":"2026-09-01T20:03:15Z","fixes":[{"ecosystem":"Debian:12","package":"opensmtpd","fixed_in":["5.3.3p1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"opensmtpd","fixed_in":["5.3.3p1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"opensmtpd","fixed_in":["5.3.3p1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3p1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3p1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3p1-1"}]}]}],"products":[{"vendor":"openbsd","product":"opensmtpd"}],"references":[{"url":"http://seclists.org/oss-sec/2013/q2/362","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","evidence"]},{"url":"http://git.zx2c4.com/OpenSMTPD/commit/?id=38b26921bad5fe24ad747bf9d591330d683728b0","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://secunia.com/advisories/53353","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/84388","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://seclists.org/oss-sec/2013/q2/366","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://osvdb.org/93495","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2125"},{"url":"https://github.com/advisories/GHSA-63q3-5f3r-v5j4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2125","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-2125","description":"OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blocking) by keeping a connection open.","status":"published","published":"2014-05-27T15:00:00Z","modified":"2024-08-06T15:27:40.908Z","updated_at":"2026-11-02T14:34:55.825574Z"}],"euvd":[{"id":"EUVD-2013-2093","description":"OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blocking) by keeping a connection open.","status":"published","published":"2014-05-27T15:00:00Z","modified":"2024-08-06T15:27:40Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-63q3-5f3r-v5j4","title":"OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to...","description":"OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blocking) by keeping a connection open.","status":"published","published":"2022-05-17T01:36:20Z","modified":"2023-02-03T05:04:45Z","updated_at":"2026-11-02T14:53:37.258179Z"}],"nvd":[{"id":"CVE-2013-2125","description":"OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blocking) by keeping a connection open.","status":"published","published":"2014-05-27T14:55:09.727Z","modified":"2026-06-16T23:52:47.597Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:50.049023Z"}],"osv":[{"id":"CVE-2013-2125","description":"OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blocking) by keeping a connection open.","status":"published","published":"2014-05-27T14:55:09Z","modified":"2026-04-10T03:44:25.823041Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2125","description":"OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blocking) by keeping a connection open.","status":"published","published":"2014-05-27T14:55:09.727Z","modified":"2026-09-01T20:03:15.952093818Z","updated_at":"2026-11-02T15:45:25.514579Z"}]}}