{"id":"CVE-2020-7247","aliases":["ALPINE-CVE-2020-7247","DEBIAN-CVE-2020-7247","DSA-4611-1","EUVD-2020-28374","GHSA-rcw6-69h3-89fh","UBUNTU-CVE-2020-7247","USN-4268-1","USN-4875-1"],"status":"published","title":"smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products,...","description":"smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \"uncommented\" default configuration. The issue exists because of an incorrect return value upon failure of input validation.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.98972,"percentile":0.99929,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-252","CWE-755","CWE-78"],"published":"2020-01-29T00:00:00Z","modified":"2026-11-03T06:32:31Z","kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-03-25"},{"source":"kev","since":"2022-03-25"}],"exploits":[{"source":"metasploit","id":"exploit/unix/smtp/opensmtpd_mail_from_rce","title":"OpenSMTPD MAIL FROM Remote Code Execution","type":"exploit","platform":"Unix","date":"2020-01-28","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/smtp/opensmtpd_mail_from_rce"},{"source":"exploitdb","id":"EDB-47984","title":"OpenSMTPD 6.6.1 - Remote Code Execution","type":"remote","platform":"linux","date":"2020-01-30","verified":true,"url":"https://www.exploit-db.com/exploits/47984"},{"source":"pocgithub","id":"FiroSolutions/cve-2020-7247-exploit","title":"FiroSolutions/cve-2020-7247-exploit","date":"2020-01-30","url":"https://github.com/FiroSolutions/cve-2020-7247-exploit"},{"source":"exploitdb","id":"EDB-48038","title":"OpenSMTPD - MAIL FROM Remote Code Execution (Metasploit)","type":"remote","platform":"linux","date":"2020-02-10","verified":true,"url":"https://www.exploit-db.com/exploits/48038"},{"source":"exploitdb","id":"EDB-48051","title":"OpenSMTPD 6.4.0 \u003c 6.6.1 - Local Privilege Escalation + Remote Code Execution","type":"remote","platform":"openbsd","date":"2020-02-11","verified":true,"url":"https://www.exploit-db.com/exploits/48051"},{"source":"pocgithub","id":"superzerosec/cve-2020-7247","title":"superzerosec/cve-2020-7247","date":"2020-02-17","url":"https://github.com/superzerosec/cve-2020-7247"},{"source":"pocgithub","id":"r0lh/CVE-2020-7247","title":"r0lh/CVE-2020-7247","date":"2020-02-18","url":"https://github.com/r0lh/CVE-2020-7247"},{"source":"pocgithub","id":"QTranspose/CVE-2020-7247-exploit","title":"QTranspose/CVE-2020-7247-exploit","date":"2021-02-13","url":"https://github.com/QTranspose/CVE-2020-7247-exploit"},{"source":"pocgithub","id":"bytescrappers/CVE-2020-7247","title":"bytescrappers/CVE-2020-7247","date":"2021-06-02","url":"https://github.com/bytescrappers/CVE-2020-7247"},{"source":"pocgithub","id":"f4T1H21/CVE-2020-7247","title":"f4T1H21/CVE-2020-7247","date":"2021-06-19","url":"https://github.com/f4T1H21/CVE-2020-7247"},{"source":"pocgithub","id":"SimonSchoeni/CVE-2020-7247-POC","title":"SimonSchoeni/CVE-2020-7247-POC","date":"2021-11-26","url":"https://github.com/SimonSchoeni/CVE-2020-7247-POC"},{"source":"pocgithub","id":"presentdaypresenttime/shai_hulud","title":"presentdaypresenttime/shai_hulud","date":"2022-02-07","url":"https://github.com/presentdaypresenttime/shai_hulud"},{"source":"pocgithub","id":"minhluannguyen/CVE-2020-7247-reproducer","title":"minhluannguyen/CVE-2020-7247-reproducer","date":"2025-03-20","url":"https://github.com/minhluannguyen/CVE-2020-7247-reproducer"},{"source":"pocgithub","id":"solmin111/OpenSMTPD-CVE-2020-7247-","title":"solmin111/OpenSMTPD-CVE-2020-7247-","date":"2026-06-28","url":"https://github.com/solmin111/OpenSMTPD-CVE-2020-7247-"},{"source":"pocgithub","id":"CyberCTF/vulhub-opensmtpd-cve-2020-7247","title":"CyberCTF/vulhub-opensmtpd-cve-2020-7247","date":"2026-10-08","url":"https://github.com/CyberCTF/vulhub-opensmtpd-cve-2020-7247"},{"source":"nuclei","id":"CVE-2020-7247","title":"OpenSMTPD 6.4.0-6.6.1 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2020/CVE-2020-7247.yaml"}],"fixes":[{"ecosystem":"Alpine:v3.11","package":"opensmtpd","fixed_in":["6.6.2p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"opensmtpd","fixed_in":["6.6.2p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"opensmtpd","fixed_in":["6.6.2p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"opensmtpd","fixed_in":["6.6.2p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"opensmtpd","fixed_in":["6.6.2p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"opensmtpd","fixed_in":["6.6.2p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"opensmtpd","fixed_in":["6.6.2p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"opensmtpd","fixed_in":["6.6.2p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"opensmtpd","fixed_in":["6.6.2p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"opensmtpd","fixed_in":["6.6.2p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"opensmtpd","fixed_in":["6.6.2p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"opensmtpd","fixed_in":["6.6.2p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"opensmtpd","fixed_in":["6.6.2p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"opensmtpd","fixed_in":["6.6.2p1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"opensmtpd","fixed_in":["6.6.2p1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"opensmtpd","fixed_in":["6.6.2p1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"opensmtpd","fixed_in":["6.6.2p1-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"opensmtpd","fixed_in":["6.0.2p1-2+deb9u2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"opensmtpd","fixed_in":["6.0.3p1-5+deb10u3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"opensmtpd","fixed_in":["5.4.1p1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensmtpd","fixed_in":["5.7.3p2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"opensmtpd","fixed_in":["6.0.3p1-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2p1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2p1-2+deb9u2"}]}],"versions":["6.0.2p1-2","6.0.2p1-2+deb9u1"]},{"source":"osv","ecosystem":"Debian:10","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3p1-5+deb10u3"}]}],"versions":["6.0.3p1-5","6.0.3p1-5+deb10u1","6.0.3p1-5+deb10u2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1p1-1ubuntu0.1~esm1"}]}],"versions":["5.3.3p1-4","5.4.1p1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3p2-1ubuntu0.1~esm1"}]}],"versions":["5.4.2p1-4","5.7.3p1-1","5.7.3p2-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3p1-1ubuntu0.1"}]}],"versions":["6.0.2p1-2build1","6.0.3p1-1","6.0.3p1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3p1-1ubuntu0.1"}]}],"versions":["6.0.2p1-2build1","6.0.3p1-1","6.0.3p1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1p1-1ubuntu0.1~esm1"}]}],"versions":["5.3.3p1-4","5.4.1p1-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3p2-1ubuntu0.1~esm2"}]}],"versions":["5.4.2p1-4","5.7.3p1-1","5.7.3p2-1","5.7.3p2-1ubuntu0.1~esm1"],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"openbsd","product":"opensmtpd"}],"references":[{"url":"https://www.openbsd.org/security.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"http://www.openwall.com/lists/oss-security/2020/01/28/3","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence","report"]},{"url":"https://github.com/openbsd/src/commit/9dcfda045474d8903224d175907bfc29761dcb45","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://packetstormsecurity.com/files/156137/OpenBSD-OpenSMTPD-Privilege-Escalation-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","report"]},{"url":"https://seclists.org/bugtraq/2020/Jan/51","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://www.debian.org/security/2020/dsa-4611","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"http://packetstormsecurity.com/files/156145/OpenSMTPD-6.6.2-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","report"]},{"url":"https://www.kb.cert.org/vuls/id/390745","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource","advisory","report"]},{"url":"http://seclists.org/fulldisclosure/2020/Jan/49","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"http://packetstormsecurity.com/files/156249/OpenSMTPD-MAIL-FROM-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://packetstormsecurity.com/files/156295/OpenSMTPD-6.6.1-Local-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://usn.ubuntu.com/4268-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/162093/OpenBSD-OpenSMTPD-6.6-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-7247","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7247"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E"},{"url":"https://usn.ubuntu.com/4268-1"},{"url":"https://github.com/advisories/GHSA-rcw6-69h3-89fh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-7247","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-7247","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-7247","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/01/28/3","tags":["report"]},{"url":"https://ftp.openbsd.org/pub/OpenBSD/patches/6.6/common/019_smtpd_exec.patch.sig","tags":["report"]},{"url":"https://github.com/OpenSMTPD/OpenSMTPD/commit/be6ef06cba9484d008d9f057e6b25d863cf278ff","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4268-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7247","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4875-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-8793","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-8794","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-7247","description":"smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \"uncommented\" default configuration. The issue exists because of an incorrect return value upon failure of input validation.","status":"published","published":"2020-01-29T15:53:18Z","modified":"2025-10-21T23:35:53.008Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:35:58.787905Z"}],"euvd":[{"id":"EUVD-2020-28374","description":"smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \"uncommented\" default configuration. The issue exists because of an incorrect return value upon failure of input validation.","status":"published","published":"2020-01-29T15:53:18Z","modified":"2025-10-21T23:35:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-03-25","updated_at":"2026-11-02T20:31:24.816637Z"}],"ghsa":[{"id":"GHSA-rcw6-69h3-89fh","title":"smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products,...","description":"smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \"uncommented\" default configuration. The issue exists because of an incorrect return value upon failure of input validation.","status":"published","published":"2022-05-24T17:07:42Z","modified":"2025-10-22T00:32:54Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78","CWE-252","CWE-755"],"updated_at":"2026-11-02T15:04:07.112106Z"}],"kev":[{"id":"CVE-2020-7247","title":"OpenSMTPD Remote Code Execution Vulnerability","description":"smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.","cwes":["CWE-755","CWE-78"],"kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2020-7247","description":"smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \"uncommented\" default configuration. The issue exists because of an incorrect return value upon failure of input validation.","status":"published","published":"2020-01-29T16:15:12.897Z","modified":"2026-06-17T03:24:35.133Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78","CWE-755"],"updated_at":"2026-11-02T14:05:53.837808Z"}],"osv":[{"id":"ALPINE-CVE-2020-7247","description":"smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \"uncommented\" default configuration. The issue exists because of an incorrect return value upon failure of input validation.","status":"published","published":"2020-01-29T16:15:12.897Z","modified":"2026-11-03T06:32:31.624995852Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"CVE-2020-7247","description":"smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \"uncommented\" default configuration. The issue exists because of an incorrect return value upon failure of input validation.","status":"published","published":"2020-01-29T16:15:12.897Z","modified":"2026-10-09T13:05:23.511535028Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"DEBIAN-CVE-2020-7247","description":"smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \"uncommented\" default configuration. The issue exists because of an incorrect return value upon failure of input validation.","status":"published","published":"2020-01-29T16:15:12.897Z","modified":"2026-10-26T12:02:48.364188079Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"UBUNTU-CVE-2020-7247","description":"smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \"uncommented\" default configuration. The issue exists because of an incorrect return value upon failure of input validation.","status":"published","published":"2020-01-29T16:15:00Z","modified":"2026-02-04T03:46:35.846654Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"DSA-4611-1","title":"opensmtpd - security update","status":"published","published":"2020-01-29T00:00:00Z","modified":"2026-03-09T02:09:55.69571Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"USN-4268-1","title":"OpenSMTPD vulnerability","description":"It was discovered that OpenSMTPD incorrectly verified the sender's or\nreceiver's e-mail addresses under certain conditions. An attacker could use\nthis vulnerability to execute arbitrary commands as root.\n","status":"published","published":"2020-02-05T13:48:24Z","modified":"2026-02-10T04:41:46Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4875-1","title":"opensmtpd vulnerabilities","description":"It was discovered that OpenSMTPD incorrectly verified the sender's or\nreceiver's e-mail addresses under certain conditions. An attacker could\npossibly use this vulnerability to execute arbitrary commands as root.\n(CVE-2020-7247)\n\nIt was discovered that OpenSMTPD did not properly handle hardlinks under\ncertain conditions. An unprivileged local attacker could possibly use this\nissue to obtain sensitive information. This issue only affected Ubuntu\n16.04 ESM. (CVE-2020-8793)\n\nIt was discovered that OpenSMTPD mishandled certain input. A remote,\nunauthenticated attacker could possibly use this vulnerability to execute\narbitrary shell commands as any non-root user. This issue only affected\nUbuntu 16.04 ESM. (CVE-2020-8794)\n","status":"published","published":"2021-03-15T23:06:41Z","modified":"2026-06-29T13:48:38.635633199Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}