CVE-2020-35573: 
NixOS vulnerability analysis and mitigation

srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS address. The vulnerability was discovered and disclosed on December 20, 2020, affecting PostSRSd installations prior to version 1.10. This security issue has been assigned CVE-2020-35573 with a CVSS v3.1 base score of 7.5 (HIGH) (NVD).

The vulnerability exists in the srs2.c file of PostSRSd and is related to improper handling of timestamp tags in SRS addresses. The issue occurs when processing SRS addresses with excessively long timestamp tags, which can lead to excessive CPU consumption. The vulnerability has been assigned CWE-834 (Excessive Iteration) and has a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating it can be exploited remotely with low attack complexity and requires no privileges or user interaction (NVD).

The vulnerability can result in a denial of service condition through CPU consumption when the application processes specially crafted SRS addresses. The impact is limited to availability, with no effect on confidentiality or integrity of the system (Ubuntu Security).

The vulnerability can be exploited remotely by sending an SRS address containing a maliciously crafted long timestamp tag to the affected PostSRSd installation. The attack requires no special privileges or user interaction, making it relatively straightforward to exploit (NVD).

The vulnerability has been fixed in PostSRSd version 1.10 and later. The fix involves adding a length check for timestamp tags. Users are advised to upgrade to version 1.10 or later. For Ubuntu 18.04 users, the fixed version is 1.4-1ubuntu0.1 (Ubuntu Notice, GitHub Patch).