An out-of-bounds read introduced in commit 80c6a60c, "when peer outputs a multi-line response ..." could lead to remote code execution either as root, after May 2018 (commit a8e22235, "switch smtpd to new grammar"); or as any non-root user, before May 2018. Upstream advisory: https://www.openwall.com/lists/oss-security/2020/02/24/5
Created opensmtpd tracking bugs for this issue: Affects: epel-all [bug 1809061] Affects: fedora-all [bug 1809060]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.