CVE-2020-12063

{"id": "CVE-2020-12063", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2020-04-24T12:15:12.877", "references": [{"url": "https://www.openwall.com/lists/oss-security/2020/04/23/12", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.openwall.com/lists/oss-security/2020/04/23/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demonstrated by the similarity of \\xce\\xbf to the 'o' character. This is potentially relevant when the /etc/postfix/sender_login feature is used, because a spoofed outbound message that uses a configured sender address is blocked with a \"Sender address rejected: not logged in\" error message, but a spoofed outbound message that uses a homoglyph of a configured sender address is not blocked. NOTE: some third parties argue that any missed blocking of spoofed outbound messages - except for exact matches to a sender address in the /etc/postfix/sender_login file - is outside the design goals of Postfix and thus cannot be considered a Postfix vulnerability"}, {"lang": "es", "value": "** EN DISPUTA ** Un determinado paquete Postfix versi\u00f3n 2.10.1-7, podr\u00eda permitir a un atacante enviar un correo electr\u00f3nico desde un remitente de aspecto arbitrario por medio de un ataque de Homoglifo, como es demostrado por la similitud de \\xce\\xbf con el car\u00e1cter \"o\". Esto es potencialmente relevante cuando es usada la funcionalidad /etc/postfix/sender_login, porque un mensaje saliente falso que usa una direcci\u00f3n de remitente configurada es bloqueado con un mensaje de error \"Sender address rejected: not logged in\", pero un mensaje saliente falso que usa un homoglifo de una direcci\u00f3n de remitente configurada no es bloqueado. NOTA: Algunos terceros sostienen que cualquier bloqueo omitido de mensajes salientes falsos - excepto por coincidencias exactas con una direcci\u00f3n del remitente en el archivo de /etc/postfix/sender_login - est\u00e1 fuera de los objetivos de dise\u00f1o de Postfix y, por lo tanto, no puede ser considerada una vulnerabilidad de Postfix."}], "lastModified": "2024-08-04T12:15:43.600", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:postfix:postfix:2.10.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C851CA35-20A6-4D1E-8473-7FDFBB2F633B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}