CVE-2020-3811: 
Linux Debian vulnerability analysis and mitigation

qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability. The vulnerability was discovered in May 2020 and assigned identifier CVE-2020-3811. The issue affects netqmail 1.06 and its implementations across various distributions including Debian and Ubuntu (Debian Security, Ubuntu Security).

The vulnerability exists because qmail-verify never calls the control_init() function, which causes it to initialize its default domain to the hard-coded string "envnoathost". As a result, it accepts any unqualified mail address as valid by default since the default domain "envnoathost" is not one of qmail's local domains and is therefore unverifiable (Openwall Advisory).

An attacker could exploit this vulnerability to bypass email address validation mechanisms. This could potentially allow unauthorized email delivery or processing through affected systems (Ubuntu Security).

The vulnerability can be exploited by sending unqualified email addresses (addresses without @domain) to systems running the affected versions of netqmail. The exploit does not require special privileges or complex attack vectors (Openwall Advisory).

The vulnerability has been fixed in updated versions of netqmail: version 1.06-6.2~deb9u1 for Debian Stretch, 1.06-6.2~deb10u1 for Debian Buster, and 1.06-6.2~deb10u1build0.20.04.1 for Ubuntu 20.04 LTS. Users are recommended to upgrade their netqmail packages to these versions (Debian Security, Ubuntu Security).