CVE-2019-16378

CRITICAL 9.8CVE-2019-16378 · Published 17/09/2019 · updated 17/06/2026

In short

CVE-2019-16378 is a CRITICAL (CVSS 9.8) vulnerability affecting opendmarc (trusteddomain).
Chance of exploitation in the next 30 days (EPSS): 2.5%, higher than 84.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
opendmarc trusteddomain	`= 1.4.0≤ 1.3.2`	No fix yet

Description

OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applications that consider a domain name to be relevant to the origin of an e-mail message.

References

openwall.com/lists/oss-security/2019/09/17/2 · Mailing List
bugs.debian.org/940081 · Mailing List
trusteddomainproject/OpenDMARC#48 · Patch
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HEWDFGRKQHIWKFZH5BNWQDGUPNR7VH3
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUBIHJLMPMB6KHOSGDMUQKSAW4HOCYM
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y7RT6ID7MBCEPNZEIUKK2TZIOCYPJR6E
seclists.org/bugtraq/2019/Sep/36 · Mailing List
usn.ubuntu.com/4567-1 · Third Party Advisory
debian.org/security/2019/dsa-4526 · Third Party Advisory
openwall.com/lists/oss-security/2019/09/11/8 · Mailing List

More vulnerabilities in opendmarc

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free