CVE-2019-16378

OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applications that consider a domain name to be relevant to the origin of an e-mail message.

• CWE-290

• http://www.openwall.com/lists/oss-security/2019/09/17/2Mailing List
• https://bugs.debian.org/940081Mailing List, Third Party Advisory
• https://github.com/trusteddomainproject/OpenDMARC/pull/48Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HEWDFGRKQHIWKFZH5BNWQDGUPNR7VH3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUBIHJLMPMB6KHOSGDMUQKSAW4HOCYM/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y7RT6ID7MBCEPNZEIUKK2TZIOCYPJR6E/
• https://seclists.org/bugtraq/2019/Sep/36Mailing List, Third Party Advisory
• https://usn.ubuntu.com/4567-1/Third Party Advisory
• https://www.debian.org/security/2019/dsa-4526Third Party Advisory
• https://www.openwall.com/lists/oss-security/2019/09/11/8Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/09/17/2Mailing List
• https://bugs.debian.org/940081Mailing List, Third Party Advisory
• https://github.com/trusteddomainproject/OpenDMARC/pull/48Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HEWDFGRKQHIWKFZH5BNWQDGUPNR7VH3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUBIHJLMPMB6KHOSGDMUQKSAW4HOCYM/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y7RT6ID7MBCEPNZEIUKK2TZIOCYPJR6E/
• https://seclists.org/bugtraq/2019/Sep/36Mailing List, Third Party Advisory
• https://usn.ubuntu.com/4567-1/Third Party Advisory
• https://www.debian.org/security/2019/dsa-4526Third Party Advisory
• https://www.openwall.com/lists/oss-security/2019/09/11/8Mailing List, Third Party Advisory

Published

Sep 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1637A vulnerability in the Cisco Webex Network Recording Player …7.8
• CVE-2019-16370The PGP signing plugin in Gradle before 6.0 relies on the SH…5.9
• CVE-2019-16371LogMeIn LastPass before 4.33.0 allows attackers to construct…8.2
• CVE-2019-16374Pega Platform 8.2.1 allows LDAP injection because a username…9.8
• CVE-2019-16375An issue was discovered in Open Ticket Request System (OTRS)…5.4
• CVE-2019-16377The makandra consul gem through 1.0.2 for Ruby has Incorrect…9.8
• CVE-2019-1638A vulnerability in the Cisco Webex Network Recording Player …7.8
• CVE-2019-16382An issue was discovered in Ivanti Workspace Control 10.3.110…9.8
• CVE-2019-16383MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 b…9.4
• CVE-2019-16384Cybele Thinfinity VirtualUI 2.5.17.2 allows ../ path travers…6.5
• CVE-2019-16385Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response sp…6.1
• CVE-2019-16386PEGA Platform 7.x and 8.x is vulnerable to Information discl…4.3