CVE-2020-12272: 
NixOS vulnerability analysis and mitigation

OpenDMARC through 1.3.2 and 1.4.x contains a vulnerability (CVE-2020-12272) that allows attackers to inject authentication results to provide false information about the domain that originated an e-mail message. This vulnerability was discovered in April 2020 and affects the DMARC email authentication system. The issue is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com substring (NVD, CVE).

The vulnerability has a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The issue stems from inconsistencies between SPF/DKIM components and OpenDMARC in parsing authentication results. When SPF and DKIM components forward their authentication results to the DMARC component, the DMARC component may parse these results differently than intended, leading to authentication bypass (SourceForge Ticket).

The vulnerability allows attackers to bypass DMARC authentication by providing false information about the originating domain of an email message. This could enable email spoofing attacks where malicious actors can send emails that appear to come from legitimate domains, potentially leading to phishing or other email-based attacks (USENIX Paper).

The vulnerability is exploitable through two types of injection attacks: DKIM authentication results injection and SPF authentication results injection. Attackers can craft malformed domains using special characters that are interpreted differently by SPF/DKIM components versus DMARC components (SourceForge Ticket).

The vulnerability has been fixed in newer versions of OpenDMARC. Various Linux distributions have released security updates to address this issue. For example, Debian has released version 1.3.2-6+deb10u3 for Debian 10 buster, and Fedora has released version 1.4.1-1 for Fedora 33 and 34 (Debian Advisory, Fedora Update).