NULL pointer dereference in OpenDMARC - CVE-2024-25768

Vulnerability identifier: #VU99519

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-25768

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in libopendmarc/opendmarc_policy.c. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

OpenDMARC
Fedora
openEuler
opendmarc
libopendmarc
libopendmarc-devel
opendmarc-debuginfo
opendmarc-debugsource

Cybersecurity Help is currently unaware of any official solution to address this vulnerability..

opendmarc - update to 1.4.2-3
libopendmarc - update to 1.4.2-3
libopendmarc-devel - update to 1.4.2-3
opendmarc-debuginfo - update to 1.4.2-3
opendmarc-debugsource - update to 1.4.2-3
opendmarc - addressed in versions 1.4.2-21.el9, 1.4.2-21.fc40, 1.4.2-21.fc41, 1.4.2-21.fc42

• https://github.com/LuMingYinDetect/OpenDMARC_defects/blob/main/OpenDMARC_detect_1.md

• Denial of service in OpenDMARC
• Fedora 42 update for opendmarc
• openEuler 22.03 LTS SP3 update for opendmarc
• Fedora 40 update for opendmarc
• Fedora EPEL 9 update for opendmarc
• Fedora 41 update for opendmarc