Advisories ยป MGASA-2021-0462

Updated opendmarc packages fix security vulnerability

Publication date: 06 Oct 2021
Modification date: 06 Oct 2021
Type: security
Affected Mageia releases : 8
CVE: CVE-2019-20790 , CVE-2020-12272 , CVE-2020-12460

Description

OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows
attacks that bypass SPF and DMARC authentication in situations where the HELO
field is inconsistent with the MAIL FROM field (CVE-2019-20790).

OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication
results to provide false information about the domain that originated an e-mail
message. This is caused by incorrect parsing and interpretation of SPF/DKIM
authentication results, as demonstrated by the example.net(.example.com
substring (CVE-2020-12272).

OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null
termination in the function opendmarc_xml_parse that can result in a one-byte
heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate
report. This can cause remote memory corruption when a '\0' byte overwrites the
heap metadata of the next chunk and its PREV_INUSE flag (CVE-2020-12460).

References

SRPMS

8/core