OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations where the HELO field is inconsistent with the MAIL FROM field (CVE-2019-20790). OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication . MGASA-2021-0462 - Updated opendmarc packages fix security vulnerability Publication date: 06 Oct 2021 URL: https://advisories.mageia.org/MGASA-2021-0462.html Type: security Affected Mageia releases: 8 CVE: CVE-2019-20790, CVE-2020-12272, CVE-2020-12460 OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations where the HELO field is inconsistent with the MAIL FROM field (CVE-2019-20790). OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(. substring (CVE-2020-12272). OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report. This can cause remote memory corruption when a '\0' byte overwrites the heap metadata of the next chunk and its PREV_INUSE flag (CVE-2020-12460). References: - https://bugs.mageia.org/show_bug.cgi?id=29035 - https://github.com/trusteddomainproject/OpenDMARC/issues/111 - https://www.cve.org/CVERecord?id=CVE-2019-20790 - https://www.cve.org/CVERecord?id=CVE-2020-12272 - https://www.cve.org/CVERecord?id=CVE-2020-12460 SRPMS: - 8/core/opendmarc-1.4.1.1-1.mga8 . The latest OpenDMARC patch for Mageia 8 addresses the vulnerabilities identified in CVE-2019-20790, which presents potential threats of unauthorized access and memory misuse.. OpenDMARC, SPF, DMARC, Authentication, Mageia. .LinuxSecurity.com Team
It was discovered that OpenDMARC, a milter implementation of DMARC, has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report. This can cause remote memory . - ----------------------------------------------------------------------- Debian LTS Advisory DLA-2639-1
Get the latest Linux and open source security news straight to your inbox.