Description
Format string vulnerability in the log function in Net::Server 0.87 and earlier, as used in Postfix Greylisting Policy Server (Postgrey) 1.18 and earlier, and possibly other products, allows remote attackers to cause a denial of service (crash) via format string specifiers that are not properly handled before being sent to syslog, as demonstrated using sender addresses to Postgrey.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libnet-server-perl | 0.89-1 | — |
| Debian 14 | postgrey | 1.22-1 | — |
| Debian 13 | libnet-server-perl | 0.89-1 | — |
| Debian 13 | postgrey | 1.22-1 | — |
| Debian 12 | libnet-server-perl | 0.89-1 | — |
| Debian 12 | postgrey | 1.22-1 | — |
| Debian 3.1 | libnet-server-perl | 0.87-3sarge1 | DSA-1122 |
| Debian 3.1 | postgrey | 1.21-1sarge1 | DSA-1121 |
Advisories 2
- DSA-1122 libnet-server-perl - format string Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1121 postgrey - format string Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200608-18 vendor-advisory
- DSA-1122 vendor-advisory
- 21452 third-party-advisory
- [postgrey] 20050414 Re: Problem with crashing postgrey mailing-list
- 15517 vdb-entry
- 21164 third-party-advisory
- 20050415 Use of function "log" in Perl module Net::Server mailing-list
- 21152 third-party-advisory
- [postgrey] 20050414 Problem with crashing postgrey mailing-list
- 21149 third-party-advisory
- [postgrey] 20050414 ANNOUNCE: Postgrey 1.21 (SECURITY) mailing-list
- postgrey-logging-dos(20108) vdb-entry
- DSA-1121 vendor-advisory
- 14958 third-party-advisory
- MDKSA-2006:131 vendor-advisory
- 13193 vdb-entry