CVE-2019-16791 downgrade of effective Strict Transport Security (STS) policy in postfix-mta-sts-resolver
An attacker can downgrade the effective Strict Transport Security policy in postfix-mta-sts-resolver, bypassing TLS enforcement protections.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-16791?
CVE-2019-16791 is a medium-severity vulnerability in Snawoot postfix-mta-sts-resolver, published on 22 Jan 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In postfix-mta-sts-resolver before 0.5.1, All users can receive incorrect response from daemon under rare conditions, rendering downgrade of effective STS policy.
Weakness: CWE-757
Which versions are affected by CVE-2019-16791?
3 open source packages ship an affected version, including postfix-mta-sts-resolver. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
postfix-mta-sts-resolver PyPI | All versions | 0.5.1 |
postfix-mta-sts-resolver PyPI | All versions | 0.5.1 |
postfix-mta-sts-resolver PyPI | All versions | 0.5.1 |
Products include Postfix-Mta-Sts-Resolver Project Postfix-Mta-Sts-Resolver.
How do I fix CVE-2019-16791?
Upgrade postfix-mta-sts-resolver to 0.5.1 or later.
Is CVE-2019-16791 being exploited?
There is no known exploitation of CVE-2019-16791 in the wild and no public exploit code.
Sources
Also known as GHSA-h92m-42h4-82f6, PYSEC-2020-174, UBUNTU-CVE-2019-16791.