ID de Prueba:	1.3.6.1.4.1.25623.1.1.10.2021.0462
Categoría:	Mageia Linux Local Security Checks
Título:	Mageia: Security Advisory (MGASA-2021-0462)
Resumen:	The remote host is missing an update for the 'opendmarc' package(s) announced via the MGASA-2021-0462 advisory.
Descripción:	Summary: The remote host is missing an update for the 'opendmarc' package(s) announced via the MGASA-2021-0462 advisory. Vulnerability Insight: OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations where the HELO field is inconsistent with the MAIL FROM field (CVE-2019-20790). OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com substring (CVE-2020-12272). OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report. This can cause remote memory corruption when a '\0' byte overwrites the heap metadata of the next chunk and its PREV_INUSE flag (CVE-2020-12460). Affected Software/OS: 'opendmarc' package(s) on Mageia 8. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2019-20790 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D4JGHMALEJEWWG56DKR5OZB22TK7W5B/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KBOGOQOK3TIWWJV66MW5YWNRJAFFYGR5/ https://bugs.launchpad.net/pypolicyd-spf/+bug/1838816 https://sourceforge.net/p/opendmarc/tickets/235/ https://www.usenix.org/system/files/sec20fall_chen-jianjun_prepub_0.pdf Common Vulnerability Exposure (CVE) ID: CVE-2020-12272 https://sourceforge.net/p/opendmarc/tickets/237/ https://lists.debian.org/debian-lts-announce/2023/08/msg00035.html Common Vulnerability Exposure (CVE) ID: CVE-2020-12460 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JHDKMCZGE3W4XBP76NLI2Q7IOZHXLD4A/ https://security.gentoo.org/glsa/202011-02 https://github.com/trusteddomainproject/OpenDMARC/issues/64 https://sourceforge.net/projects/opendmarc/ https://lists.debian.org/debian-lts-announce/2021/04/msg00026.html
Copyright	Copyright (C) 2022 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.