Authentication Bypass by Spoofing in OpenDMARC - CVE-2020-12272
Published: April 27, 2020 / Updated: April 30, 2021
Vulnerability identifier: #VU34419
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-12272
CWE-ID: CWE-290
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to manipulate data.
OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com substring.
Affected software
OpenDMARC
Arch Linux
Fedora
Ubuntu
libopendmarc2 (Ubuntu package)
opendmarc (Ubuntu package)
opendmarc
Arch Linux
Fedora
Ubuntu
libopendmarc2 (Ubuntu package)
opendmarc (Ubuntu package)
opendmarc
How to mitigate CVE-2020-12272
Install update from vendor's website.
OpenDMARC - update to 1.4.0
libopendmarc2 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.3.2-3ubuntu0.2, 1.3.2-7ubuntu0.1
opendmarc (Ubuntu package) - addressed in versions Ubuntu Pro, 1.3.2-3ubuntu0.2, 1.3.2-7ubuntu0.1
opendmarc - addressed in versions 1.4.1-1.el7, 1.4.1-1.el8, 1.4.1-1.fc33, 1.4.1-1.fc34
libopendmarc2 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.3.2-3ubuntu0.2, 1.3.2-7ubuntu0.1
opendmarc (Ubuntu package) - addressed in versions Ubuntu Pro, 1.3.2-3ubuntu0.2, 1.3.2-7ubuntu0.1
opendmarc - addressed in versions 1.4.1-1.el7, 1.4.1-1.el8, 1.4.1-1.fc33, 1.4.1-1.fc34