[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSZlOOwhwcs84D98LvII37CmjE-OETtJU5TcJNt5Iclg":3,"g5a-risk:CVE-2021-33912":146},{"success":4,"data":5,"meta":144},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":40,"epssPercentile":27,"epssTimeSeries":41,"severity":42,"affectedProducts":43,"affectedProductsCount":54,"references":55,"referencesCount":75,"weaknesses":76,"weaknessesCount":85,"isActivelyExploited":86,"cisaInfo":27,"otxData":27,"relatedBlogPosts":87,"seoMetadata":88,"configurations":113,"relatedVendorCves":128,"notableEvents":129},"CVE-2021-33912","What is CVE-2021-33912?","libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of incorrect sprintf usage in SPF_record_expand_data in spf_expand.c. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g., with additional configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not.","libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail m...","2022-01-19T18:15:07.783","2024-01-15T17:15:08.16",9.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":27,"CVSSMetricV2":30,"CVSSMetricV40":27},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":28,"ImpactScore":29},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":25,"IntegrityImpact":25,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"TemporalSeverity":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":25,"ModifiedAttackVector":27,"ModifiedAttackComplexity":27,"ModifiedPrivilegesRequired":27,"ModifiedUserInteraction":27,"ModifiedScope":27,"ModifiedConfidentialityImpact":27,"ModifiedIntegrityImpact":27,"ModifiedAvailabilityImpact":27,"EnvironmentalScore":27,"EnvironmentalSeverity":27},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH","CRITICAL",null,3.9,5.9,[31],{"Source":17,"Type":18,"CVSSData":32,"BaseSeverity":25,"ExploitabilityScore":38,"ImpactScore":39,"ACInsufInfo":27,"ObtainAllPrivilege":27,"ObtainUserPrivilege":27,"ObtainOtherPrivilege":27,"UserInteractionRequired":27},{"Version":33,"VectorString":34,"AccessVector":21,"AccessComplexity":35,"Authentication":23,"ConfidentialityImpact":36,"IntegrityImpact":36,"AvailabilityImpact":36,"BaseScore":37,"BaseSeverity":27,"Exploitability":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"CollateralDamagePotential":27,"TargetDistribution":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":27,"EnvironmentalScore":27},"2.0","AV:N\u002FAC:M\u002FAu:N\u002FC:C\u002FI:C\u002FA:C","MEDIUM","COMPLETE",9.3,8.6,10,0.09643,[40,40,40,40,40,40,40],"Critical",[44,49],{"vendor":45,"product":46,"version":47,"criteria":48,"vulnerable":4},"libspf2_project","libspf2","*","cpe:2.3:a:libspf2_project:libspf2:*:*:*:*:*:*:*:*",{"vendor":50,"product":51,"version":52,"criteria":53,"vulnerable":4},"debian","debian_linux","9.0","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",2,[56,61,66,71],{"url":57,"source":58,"tags":59},"https:\u002F\u002Fgithub.com\u002Fshevek\u002Flibspf2\u002Ftree\u002F8131fe140704eaae695e76b5cd09e39bd1dd220b","GitHub",[60],"Third Party Advisory",{"url":62,"source":63,"tags":64},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2022\u002F01\u002Fmsg00015.html","Debian",[65,60],"Mailing List",{"url":67,"source":68,"tags":69},"https:\u002F\u002Fnathanielbennett.com\u002Fblog\u002Flibspf2-cve-jan-2022-disclosure","Nathanielbennett",[70,60],"Exploit",{"url":72,"source":73,"tags":74},"https:\u002F\u002Fsecurity.gentoo.org\u002Fglsa\u002F202401-22","Gentoo",[],4,[77],{"id":78,"name":79,"description":80,"extendedDescription":81,"status":82,"abstraction":83,"structure":84},"CWE-787","Out-of-bounds Write","The product writes data past the end, or before the beginning, of the intended buffer.","","Draft","Base","Simple",1,false,[],{"title":89,"metaDescription":90,"keywords":91,"canonicalUrl":92,"structuredData":93},"What is CVE-2021-33912? Vulnerability Analysis | Security Advisory | EdgeProtect","Comprehensive analysis of CVE-2021-33912, a critical severity cyber security vulnerability from 2022. libspf2 before 1.2.11 has a four-byte heap-based buffer...","CVE-2021-33912, CVE-2021-33912 vulnerability, CVE-2021-33912 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2022, CVSS score, exploit, patch, remediation, libspf2_project security, debian security, libspf2 vulnerability, debian_linux vulnerability","\u002Fwhat-is\u002Fcve-2021-33912",{"@context":94,"@type":95,"headline":89,"description":90,"datePublished":10,"dateModified":11,"author":96,"publisher":100,"about":104,"mainEntityOfPage":108,"articleSection":111,"keywords":112},"https:\u002F\u002Fschema.org","TechArticle",{"@type":97,"name":98,"url":99},"Organization","EdgeProtect","https:\u002F\u002Fedgeprotect.io",{"@type":97,"name":98,"url":99,"logo":101},{"@type":102,"url":103},"ImageObject","https:\u002F\u002Fedgeprotect.io\u002Fimg\u002Flogos\u002Fedgeprotect-logo-512.png",{"@type":105,"name":6,"description":106,"additionalType":107},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":109,"@id":110},"WebPage","https:\u002F\u002Fedgeprotect.io\u002Fwhat-is\u002Fcve-2021-33912","Cybersecurity","CVE-2021-33912, CVE-2021-33912 vulnerability, CVE-2021-33912 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[114,122],{"Operator":27,"Negate":27,"Nodes":115},[116],{"Operator":117,"Negate":27,"CPEMatch":118},"OR",[119],{"Vulnerable":4,"Criteria":48,"MatchCriteriaID":120,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":121,"VersionEndIncluding":27},"B9926529-9106-4A0B-85FA-F1E286816711","1.2.11",{"Operator":27,"Negate":27,"Nodes":123},[124],{"Operator":117,"Negate":27,"CPEMatch":125},[126],{"Vulnerable":4,"Criteria":53,"MatchCriteriaID":127,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"DEECE5FC-CACF-4496-A3E7-164736409252",[],[130,137],{"id":131,"eventType":132,"eventTime":133,"details":134,"label":135,"color":136},"9efee373-1b80-422a-b336-2c6bcf682545","HIGH_EPSS_DELTA","2025-11-19T04:05:59.471238+00:00","Daily EPSS score increased by 0.128 on 2023-12-30","EPSS Score Increased","red",{"id":138,"eventType":139,"eventTime":140,"details":141,"label":142,"color":143},"189e8cd1-3710-4989-825a-bdb280917c0c","LOW_EPSS_DELTA","2025-11-22T04:05:47.734871+00:00","Daily EPSS score decreased by 0.128 on 2023-12-30","EPSS Score Decreased","green",{"lastModified":11,"cacheTime":145,"version":33},1793245878893,{"score":147,"band":148,"action":149,"scoredAt":150},62,"Medium","Plan remediation","2026-07-01T10:27:32.860911+00:00"]