[pfx] Re: Possible (indirect) libspf2 security issues

2023-10-01 Thread Matus UHLAR - fantomas via Postfix-users
On 01.10.23 00:00, mailmary--- via Postfix-users wrote: In my case, libspf2 is a dependent package of OpenDMARC (Alma Linux, Rocky Linux, Oracle Linux) Debian too, but this problem should only appear opendmarc does SPF resolution. This seems only to happen when SPFSelfValidate is true and

[pfx] Re: Possible (indirect) libspf2 security issues

2023-10-01 Thread David Bürgin via Postfix-users
OpenDMARC only uses libspf2 if (a) it was compiled with SPF support and with libspf2 includes (configure options --with-spf --with-spf2-include --with-spf2-lib) and (b) configuration parameter SPFSelfValidate is enabled. Item (a) is the case for example in the Debian and Ubuntu package,

[pfx] Re: Possible (indirect) libspf2 security issues

2023-09-30 Thread Viktor Dukhovni via Postfix-users
On Sat, Sep 30, 2023 at 01:58:17PM -0800, Mike via Postfix-users wrote: > This is probably obvious to most, but not being a current user of > DKIM/DMARC, why don't you verify DKIM, or enforce DMARC for inbound > mail? The "problems" that DMARC attempts to solve aren't an issue on my end. I don't

[pfx] Re: Possible (indirect) libspf2 security issues

2023-09-30 Thread Wietse Venema via Postfix-users
Mike via Postfix-users: > > Quoting Viktor Dukhovni via Postfix-users : > > > On Sun, Oct 01, 2023 at 12:00:25AM +0300, mailmary--- via > > Postfix-users wrote: > > > >> In my case, libspf2 is a dependent package of OpenDMARC > > > > Not surprising, since DMARC takes both DKIM and SPF into

[pfx] Re: Possible (indirect) libspf2 security issues

2023-09-30 Thread Mike via Postfix-users
Quoting Viktor Dukhovni via Postfix-users : On Sun, Oct 01, 2023 at 12:00:25AM +0300, mailmary--- via Postfix-users wrote: In my case, libspf2 is a dependent package of OpenDMARC Not surprising, since DMARC takes both DKIM and SPF into account. On my system, I sign outgoing mail with

[pfx] Re: Possible (indirect) libspf2 security issues

2023-09-30 Thread Viktor Dukhovni via Postfix-users
On Sun, Oct 01, 2023 at 12:00:25AM +0300, mailmary--- via Postfix-users wrote: > In my case, libspf2 is a dependent package of OpenDMARC Not surprising, since DMARC takes both DKIM and SPF into account. On my system, I sign outgoing mail with DKIM, but neither verify DKIM signatures, nor

[pfx] Re: Possible (indirect) libspf2 security issues

2023-09-30 Thread mailmary--- via Postfix-users
In my case, libspf2 is a dependent package of OpenDMARC (Alma Linux, Rocky Linux, Oracle Linux) On Sat, 30 Sep 2023 16:47:30 -0400 Viktor Dukhovni via Postfix-users wrote: > Recent news of security issues in Exim appear to in part implicate > libspf2. > > While Postfix does not directly