CVE-2019-16378

CRITICAL

OpenDMARC <1.3.2, <1.4.0-Beta1 - Signature Bypass

Title source: llm
STIX 2.1

Description

OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applications that consider a domain name to be relevant to the origin of an e-mail message.

References (10)

Core 10
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/trusteddomainproject/OpenDMARC/pull/48
Mailing List, Third Party Advisory x_refsource_misc
https://bugs.debian.org/940081
Mailing List, Third Party Advisory x_refsource_misc
https://www.openwall.com/lists/oss-security/2019/09/11/8
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/09/17/2
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2019/dsa-4526
Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/Sep/36
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4567-1/

Scores

CVSS v3 9.8
EPSS 0.0095
EPSS Percentile 76.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-290
Status published
Products (8)
canonical/ubuntu_linux 18.04
debian/debian_linux 9.0
debian/debian_linux 10.0
fedoraproject/fedora 29
fedoraproject/fedora 30
fedoraproject/fedora 31
trusteddomain/opendmarc 1.4.0 beta (2 CPE variants)
trusteddomain/opendmarc < 1.3.2
Published Sep 17, 2019
Tracked Since Feb 18, 2026