Vulnerability · Published May 26, 2020 · Assigned by debian

CVE-2020-3812

Medium 5.5

In plain English

A medium-severity security flaw in netqmail from Debian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS NVD)5.5Medium

Exploit odds (30 days)0.4%top 63.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories anywhere in the filesystem because qmail-verify runs as root and tests for the existence of files in the attacker's home directory, without dropping its privileges first.

Affected products (as reported)

Vendor	Product	Versions
Debian	netqmail	1.06

References

https://www.openwall.com/lists/oss-security/2020/05/19/8 x_refsource_MISC
https://bugs.debian.org/961060 x_refsource_MISC
https://www.debian.org/security/2020/dsa-4692 x_refsource_MISC
[debian-lts-announce] 20200604 [SECURITY] [DLA 2234-1] netqmail security update mailing-list, x_refsource_MLIST
USN-4556-1 vendor-advisory, x_refsource_UBUNTU