{"id":"CVE-2020-8793","aliases":["DEBIAN-CVE-2020-8793","EUVD-2020-29641","GHSA-m2cf-xghm-rxmc","UBUNTU-CVE-2020-8793","USN-4294-1","USN-4875-1"],"status":"published","title":"OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux...","description":"OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00866,"percentile":0.59102,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-367","CWE-426"],"published":"2020-02-25T16:22:02Z","modified":"2026-10-26T12:02:54Z","exploits":[{"source":"exploitdb","id":"EDB-48139","title":"OpenSMTPD 6.6.3 - Arbitrary File Read","type":"remote","platform":"linux","date":"2020-02-26","url":"https://www.exploit-db.com/exploits/48139"}],"fixes":[{"ecosystem":"Debian:12","package":"opensmtpd","fixed_in":["6.6.4p1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"opensmtpd","fixed_in":["6.6.4p1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"opensmtpd","fixed_in":["6.6.4p1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensmtpd","fixed_in":["5.7.3p2-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"opensmtpd","fixed_in":["6.0.3p1-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"opensmtpd","fixed_in":["6.6.4p1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.4p1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.4p1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.4p1-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.3p1-4","5.4.1p1-1","5.4.1p1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3p2-1ubuntu0.1~esm2"}]}],"versions":["5.4.2p1-4","5.7.3p1-1","5.7.3p2-1","5.7.3p2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3p1-1ubuntu0.2"}]}],"versions":["6.0.2p1-2build1","6.0.3p1-1","6.0.3p1-1build1","6.0.3p1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.4p1-1"}]}],"versions":["6.0.3p1-6","6.0.3p1-6build1","6.6.1p1-1","6.6.1p1-3","6.6.1p1-4","6.6.1p1-5","6.6.2p1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3p1-1ubuntu0.2"}]}],"versions":["6.0.2p1-2build1","6.0.3p1-1","6.0.3p1-1build1","6.0.3p1-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1p1-1ubuntu0.1~esm1"}]}],"versions":["5.3.3p1-4","5.4.1p1-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensmtpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3p2-1ubuntu0.1~esm2"}]}],"versions":["5.4.2p1-4","5.7.3p1-1","5.7.3p2-1","5.7.3p2-1ubuntu0.1~esm1"],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensmtpd","product":"opensmtpd"}],"references":[{"url":"https://www.openbsd.org/security.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2020/02/24/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"http://seclists.org/fulldisclosure/2020/Feb/28","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4294-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8793"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E/"},{"url":"https://github.com/advisories/GHSA-m2cf-xghm-rxmc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-8793","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-8793","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4294-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4875-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8793","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-8794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-7247","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-8793","description":"OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.","status":"published","published":"2020-02-25T16:22:02Z","modified":"2024-08-04T10:12:10.988Z","updated_at":"2026-11-02T14:35:50.88562Z"}],"euvd":[{"id":"EUVD-2020-29641","description":"OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.","status":"published","published":"2020-02-25T16:22:02Z","modified":"2024-08-04T10:12:10Z","updated_at":"2026-11-03T03:07:56.155078Z"}],"ghsa":[{"id":"GHSA-m2cf-xghm-rxmc","title":"OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux...","description":"OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.","status":"published","published":"2022-05-24T17:09:37Z","modified":"2023-01-29T05:01:30Z","cwes":["CWE-426"],"updated_at":"2026-11-02T14:44:50.331765Z"}],"nvd":[{"id":"CVE-2020-8793","description":"OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.","status":"published","published":"2020-02-25T17:15:13.103Z","modified":"2026-06-17T03:26:57.2Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.7,"vector":"AV:L/AC:M/Au:N/C:C/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-367","CWE-426"],"updated_at":"2026-11-02T14:05:54.796125Z"}],"osv":[{"id":"CVE-2020-8793","description":"OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.","status":"published","published":"2020-02-25T17:15:13.103Z","modified":"2026-10-24T14:24:37.753024246Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"DEBIAN-CVE-2020-8793","description":"OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.","status":"published","published":"2020-02-25T17:15:13.103Z","modified":"2026-10-26T12:02:54.920850461Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"UBUNTU-CVE-2020-8793","description":"OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.","status":"published","published":"2020-02-25T17:15:00Z","modified":"2026-02-04T04:29:55.829815Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"USN-4294-1","title":"OpenSMTPD vulnerabilities","description":"It was discovered that OpenSMTPD mishandled certain input. A remote,\nunauthenticated attacker could use this vulnerability to execute arbitrary\nshell commands as any non-root user. (CVE-2020-8794)\n\nIt was discovered that OpenSMTPD did not properly handle hardlinks under\ncertain conditions. An unprivileged local attacker could read the first\nline of any file on the filesystem. (CVE-2020-8793)\n","status":"published","published":"2020-03-02T18:17:27Z","modified":"2026-04-27T15:34:28.874295Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4875-1","title":"opensmtpd vulnerabilities","description":"It was discovered that OpenSMTPD incorrectly verified the sender's or\nreceiver's e-mail addresses under certain conditions. An attacker could\npossibly use this vulnerability to execute arbitrary commands as root.\n(CVE-2020-7247)\n\nIt was discovered that OpenSMTPD did not properly handle hardlinks under\ncertain conditions. An unprivileged local attacker could possibly use this\nissue to obtain sensitive information. This issue only affected Ubuntu\n16.04 ESM. (CVE-2020-8793)\n\nIt was discovered that OpenSMTPD mishandled certain input. A remote,\nunauthenticated attacker could possibly use this vulnerability to execute\narbitrary shell commands as any non-root user. This issue only affected\nUbuntu 16.04 ESM. (CVE-2020-8794)\n","status":"published","published":"2021-03-15T23:06:41Z","modified":"2026-06-29T13:48:38.635633199Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}