CVE-2019-16791

downgrade of effective Strict Transport Security (STS) policy in postfix-mta-sts-resolver

State: Published
Severity: 6.9 Medium
Published: Jan 22, 2020
Updated: Aug 5, 2024
Reserved: Sep 24, 2019

Description

In postfix-mta-sts-resolver before 0.5.1, All users can receive incorrect response from daemon under rare conditions, rendering downgrade of effective STS policy.

Scores

CVSS	Score	Vector	Source
3.1	6.9 Medium	CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

Affected Products

Product	Versions
postfix-mta-sts-resolverSnawoot	< 0.5.1Affected

References

https://github.com/Snawoot/postfix-mta-sts-resolver/security/advisories/GHSA-h92m-42h4-82f6
https://gist.github.com/Snawoot/b9da85d6b26dea5460673b29df1adc6b

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.