CVE-2020-12272

Name	CVE-2020-12272
Description	OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com substring.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3546-1
Debian Bugs	977767

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
opendmarc (PTS)	bullseye	1.4.0~beta1+dfsg-6+deb11u1	fixed
	bookworm	1.4.2-2	fixed
	trixie	1.4.2-5	fixed
	forky, sid	1.4.2-5.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
opendmarc	source	buster	1.3.2-6+deb10u3		DLA-3546-1
opendmarc	source	(unstable)	1.4.0~beta1+dfsg-4			977767

Notes

[stretch] - opendmarc <postponed> (Minor issue; can be fixed in next update)
https://sourceforge.net/p/opendmarc/tickets/237/
https://www.usenix.org/system/files/sec20fall_chen-jianjun_prepub_0.pdf
Fix: https://github.com/trusteddomainproject/OpenDMARC/commit/f3a9a9d4edfaa05102292727d021683f58aa4b6e