CVE-2020-12272

OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com substring.

References

Affected packages

Git / github.com/trusteddomainproject/opendmarc

Affected ranges

Type: GIT
Repo: https://github.com/trusteddomainproject/opendmarc
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

a29adab78ea9b6625066fdc482eae0ec6aa19ca6

Introduced

44b92727f8fc60e9481ef319c186387f8a8b6aa1

Last affected

0d65077648569076c103b73f30ca86c14e1811a5

Affected versions

Other

draft-dmarc-base-00-03

draft-dmarc-base-03

rel-opendmarc-1-0-0

rel-opendmarc-1-0-1

rel-opendmarc-1-1-0

rel-opendmarc-1-1-0-Beta0

rel-opendmarc-1-1-0-Beta1

rel-opendmarc-1-1-0-Beta2

rel-opendmarc-1-1-1

rel-opendmarc-1-1-2

rel-opendmarc-1-1-3

rel-opendmarc-1-2-0

rel-opendmarc-1-2-0-Beta0

rel-opendmarc-1-2-0-Beta1

rel-opendmarc-1-2-0-Beta2

rel-opendmarc-1-2-0-Beta3

rel-opendmarc-1-2-1-Beta0

rel-opendmarc-1-2-1-Beta1

rel-opendmarc-1-2-1-Beta2

rel-opendmarc-1-3-0

rel-opendmarc-1-3-0-Beta0

rel-opendmarc-1-3-0-Beta1

rel-opendmarc-1-3-0-Beta2

rel-opendmarc-1-3-0-Beta3

rel-opendmarc-1-3-0-Beta4

rel-opendmarc-1-3-1

rel-opendmarc-1-3-1-Beta0

rel-opendmarc-1-3-1-Beta1

rel-opendmarc-1-3-2

rel-opendmarc-1-3-3

rel-opendmarc-1-4-0

rel-opendmarc-1-4-0-Beta0

rel-opendmarc-1-4-0-Beta1

rel-opendmarc-1-4-0-Beta2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-12272.json"