| tiêu đề | The Trusted Domain Project OpenDKIM 2.11.0 Improper Input Validation |
|---|
| Mô tả | OpenDKIM 2.11.0 incorrectly parses certain RFC-valid values in the DKIM-Signature header. An i= identity containing an additional or escaped at-sign, or a d= domain ending in a trailing dot, can desynchronize the tag tokenizer because it treats characters inside a tag value as structural delimiters instead of parsing the semicolon-separated tag list correctly.
As a result, a cryptographically valid rsa-sha256 signature may be reported as dkim=permerror. OpenDKIM may also emit an incorrect Authentication-Results value such as header.a=rsa-sha1, even though the signature specifies a=rsa-sha256.
The issue can be triggered remotely by a sender using a valid DKIM key for a domain they control. No victim signing key, authentication, or user interaction is required. Legitimate messages using these valid signature forms may fail DKIM and consequently fail DMARC on OpenDKIM-based receivers, causing rejection or quarantine. The incorrect header.a value also compromises the integrity of authentication metadata consumed by downstream policy engines, monitoring systems, and security dashboards. |
|---|
| Nguồn | ⚠️ https://xuyongzhe-vt.github.io/share/opendkim-tag-parser-desync.html |
|---|
| Người dùng | yongzhe_xu (UID 100420) |
|---|
| Đệ trình | 07/08/2026 05:33 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 28/09/2026 13:52 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 411034 [Trusted Domain Project OpenDKIM đến 2.11.0 Tag Tokenizer dkim.c dkim_process_set] |
|---|
| điểm | 20 |
|---|