CVE-2019-16791
postfix-mta-sts-resolver Algorithm Downgrade vulnerability
Impact
## Incorrect query parsing ### Impact All users of versions prior to 0.5.1 can receive incorrect response from daemon under rare conditions, rendering downgrade of effective STS policy. ### Patches Problem has been patched in version 0.5.1 ### Workarounds Users may remediate this vulnerability without upgrading by applying [these patches](https://gist.github.com/Snawoot/b9da85d6b26dea5460673b29df1adc6b) to older suppoorted versions. ### For more information If you have any questions or comments about this advisory: * Open an issue in [postfix-mta-sts-resolver repo](https://github.com/Snawoot/postfix-mta-sts-resolver) * Email me at [vladislav at vm-0 dot com](mailto:vladislav-ex-gh-advisory@vm-0.com)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | postfix-mta-sts-resolver | < 0.5.1 | 0.5.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Postfix-Mta-Sts-Resolver Project | Postfix-Mta-Sts-Resolver | before 0.5.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/Snawoot/b9da85d6b26dea5460673b29df1adc6b
- https://github.com/Snawoot/postfix-mta-sts-resolver/security/advisories/GHSA-h92m-42h4-82f6
- https://github.com/advisories/GHSA-h92m-42h4-82f6
- https://nvd.nist.gov/vuln/detail/CVE-2019-16791
- https://github.com/pypa/advisory-database/tree/main/vulns/postfix-mta-sts-resolver/PYSEC-2020-174.yaml