Mageia 2021-0462: opendmarc security update

Advisories

MGASA-2021-0462 - Updated opendmarc packages fix security vulnerability

Publication date: 06 Oct 2021
URL: https://advisories.mageia.org/MGASA-2021-0462.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2019-20790,
     CVE-2020-12272,
     CVE-2020-12460

OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows
attacks that bypass SPF and DMARC authentication in situations where the HELO
field is inconsistent with the MAIL FROM field (CVE-2019-20790).

OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication
results to provide false information about the domain that originated an e-mail
message. This is caused by incorrect parsing and interpretation of SPF/DKIM
authentication results, as demonstrated by the example.net(.example.com
substring (CVE-2020-12272).

OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null
termination in the function opendmarc_xml_parse that can result in a one-byte
heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate
report. This can cause remote memory corruption when a '\0' byte overwrites the
heap metadata of the next chunk and its PREV_INUSE flag (CVE-2020-12460).

References:
- https://bugs.mageia.org/show_bug.cgi?id=29035
- https://github.com/trusteddomainproject/OpenDMARC/issues/111
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20790
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12272
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12460

SRPMS:
- 8/core/opendmarc-1.4.1.1-1.mga8

Mageia 2021-0462: opendmarc security update

OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations where the HELO field is inconsistent wi...

Summary

OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations where the HELO field is inconsistent with the MAIL FROM field (CVE-2019-20790).
OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com substring (CVE-2020-12272).
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report. This can cause remote memory corruption when a '\0' byte overwrites the heap metadata of the next chunk and its PREV_INUSE flag (CVE-2020-12460).

References

- https://bugs.mageia.org/show_bug.cgi?id=29035

- https://github.com/trusteddomainproject/OpenDMARC/issues/111

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20790

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12272

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12460

Resolution

MGASA-2021-0462 - Updated opendmarc packages fix security vulnerability

SRPMS

- 8/core/opendmarc-1.4.1.1-1.mga8

Severity
Publication date: 06 Oct 2021
URL: https://advisories.mageia.org/MGASA-2021-0462.html
Type: security
CVE: CVE-2019-20790, CVE-2020-12272, CVE-2020-12460

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.