[ASA-202105-13] opendmarc: multiple issues
diabonas at archlinux.org
Thu May 20 18:06:15 UTC 2021
Arch Linux Security Advisory ASA-202105-13
Date : 2021-05-19
CVE-ID : CVE-2019-20790 CVE-2020-12272
Package : opendmarc
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1375
The package opendmarc before version 188.8.131.52-1 is vulnerable to
multiple issues including content spoofing and authentication bypass.
Upgrade to 184.108.40.206-1.
# pacman -Syu "opendmarc>=220.127.116.11-1"
The problems have been fixed upstream in version 18.104.22.168.
- CVE-2019-20790 (authentication bypass)
OpenDMARC before 1.4.1, when used with pypolicyd-spf 2.0.2, allows
attacks that bypass SPF and DMARC authentication in situations where
the HELO field is inconsistent with the MAIL FROM field.
- CVE-2020-12272 (content spoofing)
OpenDMARC before 1.4.1 allows attacks that inject authentication
results to provide false information about the domain that originated
an e-mail message. This is caused by incorrect parsing and
interpretation of SPF/DKIM authentication results, as demonstrated by
the example.net(.example.com substring.
OpenDMARC has added checking to validate that the domain element in
both SPF and DKIM header fields being inspected argument contains only
valid domain name characters. This has been fixed as of OpenDMARC 1.4.1
A remote attacker could spoof SPF, DMARC and DKIM authentication
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security