CVE-2013-2125

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-05-27 · updated 2026-06-16
Weakness: CWE-310

Description

OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blocking) by keeping a connection open.

Affected products

OpenBSD Opensmtpd: through 5.3.1

References

http://git.zx2c4.com/OpenSMTPD/commit/?id=38b26921bad5fe24ad747bf9d591330d683728b0
http://osvdb.org/93495
http://seclists.org/oss-sec/2013/q2/362
http://seclists.org/oss-sec/2013/q2/366
http://secunia.com/advisories/53353
https://exchange.xforce.ibmcloud.com/vulnerabilities/84388
http://git.zx2c4.com/OpenSMTPD/commit/?id=38b26921bad5fe24ad747bf9d591330d683728b0
http://osvdb.org/93495
http://seclists.org/oss-sec/2013/q2/362
http://seclists.org/oss-sec/2013/q2/366
http://secunia.com/advisories/53353
https://exchange.xforce.ibmcloud.com/vulnerabilities/84388

Get alerted when CVE-2013-2125 or the next vulnerability affects your stack