CVE-2020-3811 — Improper Initialization in Netqmail

CWE-665 — Improper InitializationCWE-863 — Incorrect AuthorizationCWE-20 — Improper Input Validation7 documents5 sources
Severity
7.5HIGHNVD
OSV9.8
EPSS
0.4%
top 37.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
NetqmailDebian NetqmailCanonical Ubuntu Linux+1 more
Timeline
PublishedMay 26
Latest updateMay 24

Description

qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶Ubuntunetqmail/netqmail< 1.06-6.2~deb10u1build0.16.04.1+3
▶CVEListV5debian/netqmail1.06

Also affects: Debian Linux 10.0, 9.0, Ubuntu Linux 20.04

Patches

Patch: www.openwall.com ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-w7qp-9896-2fvp: qmail-verify as used in netqmail 1↗2022-05-24
▶
OSV
netqmail vulnerabilities↗2020-09-29
▶
CVEList
CVE-2020-3811: qmail-verify as used in netqmail 1↗2020-05-26
▶
OSV
CVE-2020-3811: qmail-verify as used in netqmail 1↗2020-05-26
▶

📋Vendor Advisories

2
Ubuntu
netqmail vulnerabilities↗2020-11-05
▶
Ubuntu
netqmail vulnerabilities↗2020-09-29
▶
CVE-2020-3811 — Improper Initialization in Netqmail | cvebase