CVE-2019-20790

CRITICAL 9.8CVE-2019-20790 · Published 27/04/2020 · updated 17/06/2026

In short

CVE-2019-20790 is a CRITICAL (CVSS 9.8) vulnerability affecting pypolicyd-spf (pypolicyd-spf project), opendmarc (trusteddomain).
Chance of exploitation in the next 30 days (EPSS): 2.6%, higher than 85.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
pypolicyd-spf pypolicyd-spf_project	`= 2.0.2`	No fix yet
opendmarc trusteddomain	`= 1.4.0≥ 1.3.0, ≤ 1.3.2`	No fix yet

Description

OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations where the HELO field is inconsistent with the MAIL FROM field.

References

bugs.launchpad.net/pypolicyd-spf/+bug/1838816 · Exploit
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2D4JGHMALEJEWWG56DKR5OZB22TK7W5B
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KBOGOQOK3TIWWJV66MW5YWNRJAFFYGR5
sourceforge.net/p/opendmarc/tickets/235 · Exploit
usenix.org/system/files/sec20fall_chen-jianjun_prepub_0.pdf · Technical Description

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free