CVE-2019-16791: Vulnerability in postfix-mta-sts-resolver
Summary
CVE-2019-16791: postfix-mta-sts-resolver Algorithm Downgrade vulnerability. Affects postfix-mta-sts-resolver versions < 0.5.1. Fixed in 0.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
postfix-mta-sts-resolver is a PyPI package that provides a daemon for resolving MTA-STS policies. It is used to enforce secure communication between email servers. The package is susceptible to a high severity vulnerability that affects versions prior to 0.5.1.
Vulnerability Detail
The vulnerability in postfix-mta-sts-resolver is due to incorrect query parsing. Under rare conditions, users of affected versions may receive incorrect responses from the daemon, leading to the downgrade of the effective STS policy. This can potentially compromise the security of email communication. The vulnerability has a CVSS score of 6.9.
How To Fix
Minimum fixed version
0.5.1
This is the first release that contains the fix.
pip install --upgrade "postfix-mta-sts-resolver==0.5.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users who are unable to upgrade to version 0.5.1, a workaround is available. They can apply the provided patches to older supported versions. The patches can be found at the following link: Patches for postfix-mta-sts-resolver.
Conclusion
The vulnerability in postfix-mta-sts-resolver can lead to the downgrade of the effective STS policy, compromising the security of email communication. Users should upgrade to version 0.5.1 or apply the provided patches to mitigate the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for postfix-mta-sts-resolver →
FAQ
postfix-mta-sts-resolver is a PyPI package used for resolving MTA-STS policies and enforcing secure communication between email servers.
Under rare conditions, the vulnerability can result in incorrect responses from the daemon, leading to the downgrade of the effective STS policy. This can compromise the security of email communication.
To fix this vulnerability, upgrade to version 0.5.1 of postfix-mta-sts-resolver.
Yes, users who cannot upgrade to version 0.5.1 can apply the provided patches to older supported versions.
For more information, you can open an issue in the postfix-mta-sts-resolver repository or email vladislav at vm-0 dot com.
Related vulnerabilities
Recent vulnerabilities recorded for postfix-mta-sts-resolver.
