Описание
An issue was discovered in OpenDKIM through 2.10.3, and 2.11.x through 2.11.0-Beta2. It fails to keep track of ordinal numbers when removing fake Authentication-Results header fields, which allows a remote attacker to craft an e-mail message with a fake sender address such that programs that rely on Authentication-Results from OpenDKIM will treat the message as having a valid DKIM signature when in fact it has none.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| opendkim | fixed | 2.11.0~beta2-9 | package | |
| opendkim | fixed | 2.11.0~beta2-8+deb12u1 | bookworm | package |
| opendkim | fixed | 2.11.0~beta2-4+deb11u1 | bullseye | package |
Примечания
https://github.com/trusteddomainproject/OpenDKIM/issues/148
https://github.com/trusteddomainproject/OpenDKIM/pull/287
Fixed by: https://github.com/trusteddomainproject/OpenDKIM/commit/7c70ee7c86da1cecc621182355cc950d3b193314
EPSS
Связанные уязвимости
An issue was discovered in OpenDKIM through 2.10.3, and 2.11.x through 2.11.0-Beta2. It fails to keep track of ordinal numbers when removing fake Authentication-Results header fields, which allows a remote attacker to craft an e-mail message with a fake sender address such that programs that rely on Authentication-Results from OpenDKIM will treat the message as having a valid DKIM signature when in fact it has none.
An issue was discovered in OpenDKIM through 2.10.3, and 2.11.x through 2.11.0-Beta2. It fails to keep track of ordinal numbers when removing fake Authentication-Results header fields, which allows a remote attacker to craft an e-mail message with a fake sender address such that programs that rely on Authentication-Results from OpenDKIM will treat the message as having a valid DKIM signature when in fact it has none.
An issue was discovered in OpenDKIM through 2.10.3, and 2.11.x through 2.11.0-Beta2. It fails to keep track of ordinal numbers when removing fake Authentication-Results header fields, which allows a remote attacker to craft an e-mail message with a fake sender address such that programs that rely on Authentication-Results from OpenDKIM will treat the message as having a valid DKIM signature when in fact it has none.
Уязвимость компонента Fake Authentication Result Handler программного обеспечения DKIM-фильтра OpenDKIM, позволяющая нарушителю оказывать влияние на целостность защищаемой информации
EPSS