CVE-2021-35525: 
NixOS vulnerability analysis and mitigation

CVE-2021-35525 affects PostSRSd versions before 1.11, allowing a denial of service (subprocess hang) condition if Postfix sends certain long data fields such as multiple concatenated email addresses. The vulnerability was discovered and reported by Mateusz Jończyk, with the fix released on March 21, 2021 (GitHub Release).

The vulnerability occurs when PostSRSd's subprocess that communicates with Postfix encounters overly long GET requests. The issue stems from the fread()/fwrite() logic in the subprocess becoming confused by remaining input line in its buffer. While theoretically this error should never occur as Postfix is supposed to send valid email addresses shorter than the buffer (even with percent-encoding), Postfix sometimes sends malformed requests with multiple concatenated email addresses (GitHub Commit).

The vulnerability can result in a denial of service condition where the PostSRSd subprocess hangs, potentially disrupting email processing services (Gentoo Security).

The PostSRSd maintainer noted that the vulnerability's exploitability is limited, stating 'I'm not sure if there's a reliable way to trigger this condition by an external attacker.' However, it can be triggered if Postfix is manipulated into passing a whole list of addresses as a single query to PostSRSd (GitHub Release).

The vulnerability was fixed in PostSRSd version 1.11. Users are advised to upgrade to this version or later. For Gentoo users, the fix can be applied by running 'emerge --sync' followed by 'emerge --ask --oneshot --verbose ">=mail-filter/postsrsd-1.11"' (Gentoo Security).