CVE-2023-29323 (published 2023-04-04T23:15Z)

ascii_load_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7.0.0-portable commit f748277, can abort upon a connection from a local, scoped IPv6 address.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/OpenSMTPD/OpenSMTPD
commit_details: repo_url: https://github.com/OpenSMTPD/OpenSMTPD
author: eric
author_date: 2021-09-22 17:12:34+00:00
msg: bump version to 7.0.0
repository: repo_url: https://github.com/OpenSMTPD/OpenSMTPD
repo_name: OpenSMTPD/OpenSMTPD
description: This is official OpenSMTPD Portable repository. Forks, pull requests and other contributions are welcome!
repo_language: C
owner: OpenSMTPD
file_changes: filename: smtpd.h
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-/*	$OpenBSD: smtpd.h,v 1.670 2021/07/28 19:39:51 benno Exp $	*/
+/*	$OpenBSD: smtpd.h,v 1.671 2021/09/22 17:12:34 eric Exp $	*/
 
 /*
  * Copyright (c) 2008 Gilles Chehade <gilles@poolp.org>
@@ -79,7 +79,7 @@
 #ifndef SMTPD_NAME
 #define	SMTPD_NAME		 "OpenSMTPD"
 #endif
-#define	SMTPD_VERSION		 "6.9.0-portable"
+#define	SMTPD_VERSION		 "7.0.0-portable"
 #define SMTPD_SESSION_TIMEOUT	 300
 #define SMTPD_BACKLOG		 5
 

programming_language: C
repo_url: https://github.com/openbsd/src
commit_details: repo_url: https://github.com/openbsd/src
author: semarie
author_date: 2023-02-06 18:35:52+00:00
msg: smtpd(8) could abort due to a connection from a local, scoped ipv6 address.

avoid using inet_pton(3) which doesn't support scoped ipv6 address, and use
getaddrinfo(3) instead of.

ok millert@ florian@ kn@
repository: repo_url: https://github.com/openbsd/src
repo_name: openbsd/src
description: Read-only git conversion of OpenBSD's official CVS src repository. Pull requests not accepted - send diffs to the tech@ mailing list.
repo_language: C
owner: openbsd
file_changes: filename: envelope.c
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-/*	$OpenBSD: envelope.c,v 1.50 2022/09/24 17:08:32 millert Exp $	*/
+/*	$OpenBSD: envelope.c,v 1.51 2023/02/06 18:35:52 semarie Exp $	*/
 
 /*
  * Copyright (c) 2013 Eric Faurot <eric@openbsd.org>
@@ -270,24 +270,28 @@ ascii_load_string(char *dest, char *buf, size_t len)
 static int
 ascii_load_sockaddr(struct sockaddr_storage *ss, char *buf)
 {
-	struct sockaddr_in6 ssin6;
-	struct sockaddr_in  ssin;
-
-	memset(&ssin, 0, sizeof ssin);
-	memset(&ssin6, 0, sizeof ssin6);
-
 	if (!strcmp("local", buf)) {
 		ss->ss_family = AF_LOCAL;
 	}
 	else if (buf[0] == '[' && buf[strlen(buf)-1] == ']') {
+		struct addrinfo hints, *res0;
+		
 		buf[strlen(buf)-1] = '\0';
-		if (inet_pton(AF_INET6, buf+1, &ssin6.sin6_addr) != 1)
+
+		/* getaddrinfo() is used to support scoped addresses. */
+		memset(&hints, 0, sizeof(hints));
+		hints.ai_family = AF_INET6;
+		hints.ai_flags = AI_NUMERICHOST;
+		if (getaddrinfo(buf+1, NULL, &hints, &res0) != 0)
 			return 0;
-		ssin6.sin6_family = AF_INET6;
-		memcpy(ss, &ssin6, sizeof(ssin6));
-		ss->ss_len = sizeof(struct sockaddr_in6);
+		memcpy(ss, res0->ai_addr, res0->ai_addrlen);
+		ss->ss_len = res0->ai_addrlen;
+		freeaddrinfo(res0);
 	}
 	else {
+		struct sockaddr_in ssin;
+
+		memset(&ssin, 0, sizeof ssin);
 		if (inet_pton(AF_INET, buf, &ssin.sin_addr) != 1)
 			return 0;
 		ssin.sin_family = AF_INET;

programming_language: C