Back

CVE-2019-16378

CRITICAL

OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applications that consider a domain name to be relevant to the origin of an e-mail message.

Published: Sep 17, 2019 Modified: Jun 17, 2026
CWE-290

CVSS Metrics

CVSSv3
Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (9)

Vendor Product Version
trusteddomain opendmarc *
trusteddomain opendmarc 1.4.0
trusteddomain opendmarc 1.4.0
debian debian_linux 9.0
debian debian_linux 10.0
fedoraproject fedora 29
fedoraproject fedora 30
fedoraproject fedora 31
canonical ubuntu_linux 18.04

GitHub Security Advisory GHSA-x9f6-xw7x-fm76

OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass...

Risk Scores

CVSS Score 9.8 / 10
EPSS Score 2.46%

Top 17% most likely to be exploited

Threat Score 39.9 / 100

Data Sources

NVD EPSS GitHub