CVE-2019-16378: Canonical Ubuntu Linux

Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days.

OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applications that consider a domain name to be relevant to the origin of an e-mail message.

Affected products

• Canonical Ubuntu Linux: version 18.04 only
• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 29 only; version 30 only; version 31 only
• Trusteddomain Opendmarc: up to and including 1.3.2; version 1.4.0 only

Published 2019-09-17. Last modified 2026-06-17.