Yongzhe_Xu

**Name of the Vulnerable Software and Affected Versions** OpenDMARC versions prior to 1.4.3 **Description** A remote authentication bypass via spoofing is possible in the Multi-Record Set Handler component. The issue resides in the `opendmarc policy query dmarc()` function. **Recommendations** Update to a version newer than 1.4.2. As a temporary workaround, restrict the use of the `opendmarc policy query dmarc()` function.

**Name of the Vulnerable Software and Affected Versions** OpenDMARC versions prior to 1.4.3 **Description** A weakness exists in the PSL Wildcard Handler component within the `opendmarc get tld()` function of the `libopendmarc/opendmarc tld.c` file. A remote attacker can perform a manipulation that leads to an origin validation error. **Recommendations** Update to a version newer than 1.4.2. As a temporary mitigation, restrict the use of the `opendmarc get tld()` function.

**Name of the Vulnerable Software and Affected Versions** OpenDMARC versions prior to 1.4.3 **Description** An integer overflow occurs in the DMARC Parser component within the file `libopendmarc/opendmarc policy.c` when processing the `pct` argument. This flaw allows for remote exploitation. **Recommendations** Update to a version newer than 1.4.2.

**Name of the Vulnerable Software and Affected Versions** OpenDMARC versions prior to 1.4.3 **Description** A flaw in the SPF Macro Handler component allows for improper authentication via remote manipulation. The issue resides in the `opendmarc sp2 find mailfrom domain()` function within the `libopendmarc/opendmarc spf.c` file. **Recommendations** Apply patch c48a74c758677fc5272a73eff15ffdbf8afda1a6 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Trusted Domain Project OpenDMARC versions prior to 1.4.3 **Description** A remote attack is possible due to the improper handling of exceptional conditions within the `strcasecmp()` function located in the `libopendmarc/opendmarc policy.c` library. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trusted Domain Project OpenDMARC versions prior to 1.4.3 **Description** An issue exists in the `opendmarc policy parse dmarc()` function within the `libopendmarc/opendmarc policy.c` library. Remote exploitation is possible through the manipulation of the `fo`, `rf`, `ri`, `pct`, `sp`, `adkim`, `aspf`, `rua`, or `ruf` arguments, which leads to the handling of exceptional conditions. **Recommendations** Update Trusted Domain Project OpenDMARC to a version newer than 1.4.2.

**Name of the Vulnerable Software and Affected Versions** OpenDKIM versions prior to 2.11.1 **Description** A security flaw exists in the Tag Tokenizer component within the `dkim process set()` function of the `dkim.c` file. A remote attacker can perform a manipulation that results in the use of a less trusted source. **Recommendations** As a temporary workaround, consider restricting the use of the `dkim process set()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.