An out-of-bounds read introduced in commit 80c6a60c, "when peer outputs a multi-line response ..." could lead to remote code execution either
as root, after May 2018 (commit a8e22235, "switch smtpd to new grammar"); or as any non-root user, before May 2018.
Created opensmtpd tracking bugs for this issue:
Affects: epel-all [bug 1809061]
Affects: fedora-all [bug 1809060]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.