Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

modoboa-dmarc

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7PyPIAmendedPublished

    Modoboa is vulnerable to an XML External Entity Injection (XXE)

    CVE-2019-19702 · GHSA-vc42-mgr2-w34r

    Affected
    • PyPI modoboa-dmarc < 1.2.0
    Fixed in
    1.2.0· Vendor fix available
    Issue
    The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the /dev/random file within XML documents that are emailed to the address in the rua field of the DMARC records of a domain.

    Recommended action: Upgrade to 1.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →