{"id":"CVE-2020-35573","aliases":["ALPINE-CVE-2020-35573","DEBIAN-CVE-2020-35573","DLA-2502-1","EUVD-2020-23239","GHSA-vcpj-66gx-c27m","UBUNTU-CVE-2020-35573","USN-4730-1","openSUSE-SU-2021:0646-1","openSUSE-SU-2021:0669-1","openSUSE-SU-2021:1642-1","openSUSE-SU-2024:11188-1"],"status":"published","title":"srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU...","description":"srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS address.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02689,"percentile":0.85995,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-834"],"published":"2020-12-20T00:00:00Z","modified":"2026-11-03T06:32:46Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"postsrsd","fixed_in":["1.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"postsrsd","fixed_in":["1.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"postsrsd","fixed_in":["1.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"postsrsd","fixed_in":["1.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"postsrsd","fixed_in":["1.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"postsrsd","fixed_in":["1.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"postsrsd","fixed_in":["1.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"postsrsd","fixed_in":["1.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"postsrsd","fixed_in":["1.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"postsrsd","fixed_in":["1.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"postsrsd","fixed_in":["1.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"postsrsd","fixed_in":["1.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"postsrsd","fixed_in":["1.6-r4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"postsrsd","fixed_in":["1.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"postsrsd","fixed_in":["1.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"postsrsd","fixed_in":["1.10-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"postsrsd","fixed_in":["1.4-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"postsrsd","fixed_in":["1.4-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"postsrsd","fixed_in":["1.11-lp152.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"postsrsd","fixed_in":["1.11-bp152.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"postsrsd","fixed_in":["1.11-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"postsrsd","fixed_in":["1.11-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"postsrsd","fixed_in":["1.11-1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-r4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-1+deb9u1"}]}],"versions":["1.4-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-1ubuntu0.1"}]}],"versions":["1.4-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-1ubuntu0.1"}]}],"versions":["1.4-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11-lp152.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11-bp152.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"postsrsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11-1.3"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"postsrsd_project","product":"postsrsd"}],"references":[{"url":"https://github.com/roehling/postsrsd/commit/4733fb11f6bec6524bb8518c5e1a699288c26bac","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00031.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202107-08","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35573"},{"url":"https://github.com/advisories/GHSA-vcpj-66gx-c27m"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-35573","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-35573","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-35573","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4730-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-35573","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Z7RVMS6EAM6UL6CEWH7XJZ76RD77LPL6/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180251","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35573","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RCKOE2BLGX23FISPQ3WVS2WYO4VR5IUX/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NOF2UA3DXYGYPKJVCZWZ5HMXL2PTHSJR/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-35573","description":"srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS address.","status":"published","published":"2020-12-20T04:53:41Z","modified":"2024-08-04T17:09:13.406Z","updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2020-23239","description":"srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS address.","status":"published","published":"2020-12-20T04:53:41Z","modified":"2024-08-04T17:09:13Z","updated_at":"2026-11-03T03:07:05.848444Z"}],"ghsa":[{"id":"GHSA-vcpj-66gx-c27m","title":"srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU...","description":"srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS address.","status":"published","published":"2022-05-24T17:36:58Z","modified":"2024-04-04T03:03:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-834"],"updated_at":"2026-11-02T14:56:13.24073Z"}],"nvd":[{"id":"CVE-2020-35573","description":"srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS address.","status":"published","published":"2020-12-20T05:15:09.553Z","modified":"2026-06-17T03:13:57.837Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-834"],"updated_at":"2026-11-02T14:06:27.73474Z"}],"osv":[{"id":"ALPINE-CVE-2020-35573","description":"srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS address.","status":"published","published":"2020-12-20T05:15:09.553Z","modified":"2026-11-03T06:32:46.170696667Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2020-35573","description":"srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS address.","status":"published","published":"2020-12-20T05:15:09.553Z","modified":"2026-10-20T14:00:23.121872767Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-35573","description":"srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS address.","status":"published","published":"2020-12-20T05:15:09.553Z","modified":"2026-10-26T12:02:44.850088021Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"UBUNTU-CVE-2020-35573","description":"srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS address.","status":"published","published":"2020-12-20T05:15:00Z","modified":"2026-02-05T00:13:21.229399Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.179924Z"},{"id":"DLA-2502-1","title":"postsrsd - security update","status":"published","published":"2020-12-20T00:00:00Z","modified":"2026-03-09T01:19:09.866438Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"openSUSE-SU-2021:0646-1","title":"Security update for postsrsd","description":"This update for postsrsd fixes the following issues:\n\nUpdate to release 1.11 [boo#1180251]\n\n* Drop group privileges as well as user privileges\n* Fixed: The subprocess that talks to Postfix could be caused\n  to hang with a very long email address. [CVE-2020-35573]\n\nUpdate to release 1.6\n\n* Fix endianness issue with SHA-1 implementation\n* Add dual stack support\n* Make SRS separator configurable\n","status":"published","published":"2021-05-01T14:05:31Z","modified":"2026-02-04T03:40:40.628693Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0669-1","title":"Security update for postsrsd","description":"This update for postsrsd fixes the following issues:\n\nUpdate to release 1.11 [boo#1180251]\n\n* Drop group privileges as well as user privileges\n* Fixed: The subprocess that talks to Postfix could be caused\n  to hang with a very long email address. [CVE-2020-35573]\n\nUpdate to release 1.6\n\n* Fix endianness issue with SHA-1 implementation\n* Add dual stack support\n* Make SRS separator configurable\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-05-04T22:05:31Z","modified":"2026-02-04T03:53:11.84217Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1642-1","title":"Security update for postrsd","description":"\npostrsd was updated to release 1.11 [boo#1180251]:\n\n  * Drop group privileges as well as user privileges\n  * Fixed: The subprocess that talks to Postfix could be caused\n    to hang with a very long email address. [CVE-2020-35573]\n\n- Update to release 1.6\n\n  * Fix endianness issue with SHA-1 implementation\n  * Add dual stack support\n  * Make SRS separator configurable","status":"published","published":"2021-12-30T15:02:14Z","modified":"2026-02-04T03:43:20.892556Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11188-1","title":"postsrsd-1.11-1.3 on GA media","description":"These are all security issues fixed in the postsrsd-1.11-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:31:29.158455Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-4730-1","title":"postsrsd vulnerability","description":"It was discovered that PostSRSd mishandled certain input. A remote attacker\ncould use this vulnerability to cause a denial of service via a long timestamp\ntag in an SRS address.\n","status":"published","published":"2021-02-10T23:07:25Z","modified":"2026-04-27T15:49:31.491275Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}