PT-2020-10763 · Openspf+1 · Pypolicyd-Spf+1

Jianjun · Published 2020-04-27 · Updated 2022-11-16 · CVE-2019-20790

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenDMARC versions 1.3.2 and 1.4.x

Description The issue allows attacks to bypass SPF and DMARC authentication when the HELO field is inconsistent with the MAIL FROM field, specifically when OpenDMARC is used with pypolicyd-spf 2.0.2.

Recommendations For OpenDMARC versions 1.3.2 and 1.4.x, consider updating pypolicyd-spf to a version later than 2.0.2 to mitigate the risk of SPF and DMARC authentication bypass. As a temporary workaround, consider restricting the use of the HELO field to minimize the risk of exploitation.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2019-20790

MGASA-2021-0462

Affected Products

Opendmarc

Pypolicyd-Spf

References · 18

• 🔥 https://sourceforge.net/p/opendmarc/tickets/235 · Exploit
• 🔥 https://bugs.launchpad.net/pypolicyd-spf/+bug/1838816 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-20790 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0462 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0462.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-20790 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20790 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-20790 · Security Note
• https://ubuntu.com/security/CVE-2019-20790 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2D4JGHMALEJEWWG56DKR5OZB22TK7W5B · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20790 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KBOGOQOK3TIWWJV66MW5YWNRJAFFYGR5 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-20790 · Vendor Advisory
• https://github.com/trusteddomainproject/OpenDMARC/issues/111 · Note
• https://usenix.org/system/files/sec20fall_chen-jianjun_prepub_0.pdf · Note