CVE-2019-19702: Modoboa is vulnerable to an XML External Entity Injection (XXE)
(updated )
The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the /dev/random file within XML documents that are emailed to the address in the rua field of the DMARC records of a domain.
References
- github.com/advisories/GHSA-vc42-mgr2-w34r
- github.com/modoboa/modoboa-dmarc
- github.com/modoboa/modoboa-dmarc/commit/14c29e0ad9487bdbe4cc0bd1f8bc711285bf9933
- github.com/modoboa/modoboa-dmarc/issues/38
- github.com/pypa/advisory-database/tree/main/vulns/modoboa-dmarc/PYSEC-2019-105.yaml
- github.com/pypa/advisory-database/tree/main/vulns/modoboa/PYSEC-2019-251.yaml
- nvd.nist.gov/vuln/detail/CVE-2019-19702
Code Behaviors & Features
Detect and mitigate CVE-2019-19702 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →