PT-2023-9292 · Opendkim+1 · Opendkim+1
CVE-2022-48521
·
Publicado
2023-07-11
·
Atualizado
2024-08-06
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
OpenDKIM versions 2.10.3 and earlier
OpenDKIM versions 2.11.x through 2.11.0-Beta2
Description
An issue in OpenDKIM allows a remote attacker to craft an e-mail message with a fake sender address, making programs that rely on Authentication-Results from OpenDKIM treat the message as having a valid DKIM signature when in fact it has none. This is due to OpenDKIM's failure to keep track of ordinal numbers when removing fake Authentication-Results header fields.
Recommendations
For OpenDKIM versions 2.10.3 and earlier, update to a version later than 2.10.3.
For OpenDKIM versions 2.11.x through 2.11.0-Beta2, update to a version later than 2.11.0-Beta2.
As a temporary workaround, consider restricting the use of the Authentication-Results header fields until a patch is available.
Exploit
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Opendkim
Red Os