This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-12272 →

DEBIAN-CVE-2020-12272

OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that originated an e...

Original description

The description as published by the source.

OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com substring.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 opendmarc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0~beta1+dfsg-4"}]}]

Debian:13 opendmarc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0~beta1+dfsg-4"}]}]

Debian:14 opendmarc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0~beta1+dfsg-4"}]}]

References

advisory security-tracker.debian.org