ArchLinux: 202105-13: opendmarc: multiple issues

Advisories

Arch Linux Security Advisory ASA-202105-13
==========================================

Severity: Medium
Date    : 2021-05-19
CVE-ID  : CVE-2019-20790 CVE-2020-12272
Package : opendmarc
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1375

Summary
=======

The package opendmarc before version 1.4.1.1-1 is vulnerable to
multiple issues including content spoofing and authentication bypass.

Resolution
==========

Upgrade to 1.4.1.1-1.

# pacman -Syu "opendmarc>=1.4.1.1-1"

The problems have been fixed upstream in version 1.4.1.1.

Workaround
==========

None.

Description
===========

- CVE-2019-20790 (authentication bypass)

OpenDMARC before 1.4.1, when used with pypolicyd-spf 2.0.2, allows
attacks that bypass SPF and DMARC authentication in situations where
the HELO field is inconsistent with the MAIL FROM field.

- CVE-2020-12272 (content spoofing)

OpenDMARC before 1.4.1 allows attacks that inject authentication
results to provide false information about the domain that originated
an e-mail message. This is caused by incorrect parsing and
interpretation of SPF/DKIM authentication results, as demonstrated by
the example.net(.example.com substring.

OpenDMARC has added checking to validate that the domain element in
both SPF and DKIM header fields being inspected argument contains  only
valid domain name characters. This has been fixed as of OpenDMARC 1.4.1
(March 2021).

Impact
======

A remote attacker could spoof SPF, DMARC and DKIM authentication
results.

References
==========

https://github.com/trusteddomainproject/OpenDMARC/blob/develop/SECURITY/CVE-2019-20970
https://bugs.launchpad.net/pypolicyd-spf/+bug/1838816
https://sourceforge.net/p/opendmarc/tickets/235/
https://www.usenix.org/system/files/sec20fall_chen-jianjun_prepub_0.pdf
https://github.com/trusteddomainproject/OpenDMARC/issues/49
https://github.com/trusteddomainproject/OpenDMARC/issues/158
https://github.com/trusteddomainproject/OpenDMARC/commit/d72e1ec0ae6ed3a9827b31be4f268fc528232371
https://github.com/trusteddomainproject/OpenDMARC/commit/9c0db8c12e4488fbf948afc27d8395d0c6bb53bd
https://github.com/trusteddomainproject/OpenDMARC/commit/5f980792546d11bc16dff7f875188ba81989ba33
https://github.com/trusteddomainproject/OpenDMARC/blob/develop/SECURITY/CVE-2020-12272
https://sourceforge.net/p/opendmarc/tickets/237/
https://github.com/trusteddomainproject/OpenDMARC/commit/f3a9a9d4edfaa05102292727d021683f58aa4b6e
https://security.archlinux.org/CVE-2019-20790
https://security.archlinux.org/CVE-2020-12272

ArchLinux: 202105-13: opendmarc: multiple issues

May 20, 2021
The package opendmarc before version 1.4.1.1-1 is vulnerable to multiple issues including content spoofing and authentication bypass

Summary

- CVE-2019-20790 (authentication bypass)
OpenDMARC before 1.4.1, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations where the HELO field is inconsistent with the MAIL FROM field.
- CVE-2020-12272 (content spoofing)
OpenDMARC before 1.4.1 allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com substring.
OpenDMARC has added checking to validate that the domain element in both SPF and DKIM header fields being inspected argument contains only valid domain name characters. This has been fixed as of OpenDMARC 1.4.1 (March 2021).

Resolution

Upgrade to 1.4.1.1-1.
# pacman -Syu "opendmarc>=1.4.1.1-1"
The problems have been fixed upstream in version 1.4.1.1.

References

https://github.com/trusteddomainproject/OpenDMARC/blob/develop/SECURITY/CVE-2019-20970 https://bugs.launchpad.net/pypolicyd-spf/+bug/1838816 https://sourceforge.net/p/opendmarc/tickets/235/ https://www.usenix.org/system/files/sec20fall_chen-jianjun_prepub_0.pdf https://github.com/trusteddomainproject/OpenDMARC/issues/49 https://github.com/trusteddomainproject/OpenDMARC/issues/158 https://github.com/trusteddomainproject/OpenDMARC/commit/d72e1ec0ae6ed3a9827b31be4f268fc528232371 https://github.com/trusteddomainproject/OpenDMARC/commit/9c0db8c12e4488fbf948afc27d8395d0c6bb53bd https://github.com/trusteddomainproject/OpenDMARC/commit/5f980792546d11bc16dff7f875188ba81989ba33 https://github.com/trusteddomainproject/OpenDMARC/blob/develop/SECURITY/CVE-2020-12272 https://sourceforge.net/p/opendmarc/tickets/237/ https://github.com/trusteddomainproject/OpenDMARC/commit/f3a9a9d4edfaa05102292727d021683f58aa4b6e https://security.archlinux.org/CVE-2019-20790 https://security.archlinux.org/CVE-2020-12272

Severity
CVE-ID : CVE-2019-20790 CVE-2020-12272
Package : opendmarc
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1375

Impact

A remote attacker could spoof SPF, DMARC and DKIM authentication results.

Workaround

None.

Related News

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.