MGASA-2021-0462 - Updated opendmarc packages fix security vulnerability

Publication date: 06 Oct 2021
URL: https://advisories.mageia.org/MGASA-2021-0462.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2019-20790,
     CVE-2020-12272,
     CVE-2020-12460

OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows
attacks that bypass SPF and DMARC authentication in situations where the HELO
field is inconsistent with the MAIL FROM field (CVE-2019-20790).

OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication
results to provide false information about the domain that originated an e-mail
message. This is caused by incorrect parsing and interpretation of SPF/DKIM
authentication results, as demonstrated by the example.net(.
substring (CVE-2020-12272).

OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null
termination in the function opendmarc_xml_parse that can result in a one-byte
heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate
report. This can cause remote memory corruption when a '\0' byte overwrites the
heap metadata of the next chunk and its PREV_INUSE flag (CVE-2020-12460).

References:
- https://bugs.mageia.org/show_bug.cgi?id=29035
- https://github.com/trusteddomainproject/OpenDMARC/issues/111
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20790
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12272
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12460

SRPMS:
- 8/core/opendmarc-1.4.1.1-1.mga8