vulnerability
Arch Linux: Content spoofing (CVE-2020-12272)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:N/AC:L/Au:N/C:N/I:P/A:N) | Apr 27, 2020 | Jul 11, 2025 | Nov 27, 2025 |
Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
Published
Apr 27, 2020
Added
Jul 11, 2025
Modified
Nov 27, 2025
Description
OpenDMARC before 1.4.1 allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com substring.
OpenDMARC has added checking to validate that the domain element in both SPF and DKIM header fields being inspected argument contains only valid domain name characters. This has been fixed as of OpenDMARC 1.4.1 (March 2021).
OpenDMARC has added checking to validate that the domain element in both SPF and DKIM header fields being inspected argument contains only valid domain name characters. This has been fixed as of OpenDMARC 1.4.1 (March 2021).
Solution
arch-linux-upgrade-latest
References
- CVE-2020-12272
- https://attackerkb.com/topics/CVE-2020-12272
- URL-https://lists.debian.org/debian-lts-announce/2023/08/msg00035.html
- URL-https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2D4JGHMALEJEWWG56DKR5OZB22TK7W5B/
- URL-https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KBOGOQOK3TIWWJV66MW5YWNRJAFFYGR5/
- URL-https://security.archlinux.org/ASA-202105-13
- URL-https://sourceforge.net/p/opendmarc/tickets/237/
- URL-https://www.usenix.org/system/files/sec20fall_chen-jianjun_prepub_0.pdf
- CWE-290
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.