Vulnerability · Published Jun 28, 2021 · Assigned by mitre

CVE-2021-35525

Medium 5.3

In plain English

A medium-severity security flaw in the postsrsd package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.3Medium

Exploit odds (30 days)1.7%top 23.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated email addresses. NOTE: the PostSRSd maintainer acknowledges "theoretically, this error should never occur ... I'm not sure if there's a reliable way to trigger this condition by an external attacker, but it is a security bug in PostSRSd nevertheless."

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	postsrsd	1.10-2	DEBIAN-CVE-2021-35525
Debian:13	postsrsd	1.10-2	DEBIAN-CVE-2021-35525
Debian:14	postsrsd	1.10-2	DEBIAN-CVE-2021-35525
Ubuntu:22.04:LTS	postsrsd	no fix listed	UBUNTU-CVE-2021-35525
Ubuntu:24.04:LTS	postsrsd	no fix listed	UBUNTU-CVE-2021-35525
Ubuntu:25.10	postsrsd	no fix listed	UBUNTU-CVE-2021-35525
Ubuntu:26.04:LTS	postsrsd	no fix listed	UBUNTU-CVE-2021-35525

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/roehling/postsrsd/releases/tag/1.11 x_refsource_MISC
https://github.com/roehling/postsrsd/commit/077be98d8c8a9847e4ae0c7dc09e7474cbe27db2 x_refsource_MISC
https://bugs.gentoo.org/793674 x_refsource_MISC
GLSA-202107-08 vendor-advisory, x_refsource_GENTOO