CVE-2020-12272 log

Source
Severity Medium
Remote Yes
Type Content spoofing
Description
OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com substring.

OpenDMARC has added checking to validate that the domain element in both SPF and DKIM header fields being inspected argument contains  only valid domain name characters. This has been fixed as of OpenDMARC 1.4.1 (March 2021).
Group Package Affected Fixed Severity Status Ticket
AVG-1375 opendmarc 1.4.0-2 Medium Vulnerable
References
https://github.com/trusteddomainproject/OpenDMARC/blob/develop/SECURITY/CVE-2020-12272
https://www.usenix.org/system/files/sec20fall_chen-jianjun_prepub_0.pdf
https://sourceforge.net/p/opendmarc/tickets/237/
https://github.com/trusteddomainproject/OpenDMARC/commit/f3a9a9d4edfaa05102292727d021683f58aa4b6e