Parsedmarc
Monthly
Unbounded decompression of gzip and ZIP attachments in parsedmarc before 11.0.1 exposes any organization running automated DMARC report processing to remote, unauthenticated denial of service. Because `extract_report()` inflates compressed attachments with no size ceiling, a decompression bomb exploiting deflate's ~1000:1 ratio on degenerate input - e.g., a 100 KB attachment expanding to ~100 MB in RAM, with peak usage near 200 MB - exhausts host memory when parsedmarc auto-processes the email. No public exploit or active exploitation has been identified at time of analysis, but the attack surface is trivially reachable by any sender whose emails are accepted by the monitored mailbox.
Path traversal in parsedmarc 9.0.6 through 11.0.0 allows a network attacker who can send email to a monitored mailbox to write attacker-controlled files outside the intended samples directory. The flaw lives in save_output(), which names forensic failure report samples after the email Subject header but falls back to the raw unsanitized Subject when sanitization yields an empty string - which occurs whenever the Subject consists entirely of path separators or dots such as '../../../'. The attacker-supplied email body is then written as a dot-prefixed .eml file to an ancestor directory of the configured samples path. No public exploit identified at time of analysis; exploitation additionally requires the --output flag to be enabled.
Unbounded decompression of gzip and ZIP attachments in parsedmarc before 11.0.1 exposes any organization running automated DMARC report processing to remote, unauthenticated denial of service. Because `extract_report()` inflates compressed attachments with no size ceiling, a decompression bomb exploiting deflate's ~1000:1 ratio on degenerate input - e.g., a 100 KB attachment expanding to ~100 MB in RAM, with peak usage near 200 MB - exhausts host memory when parsedmarc auto-processes the email. No public exploit or active exploitation has been identified at time of analysis, but the attack surface is trivially reachable by any sender whose emails are accepted by the monitored mailbox.
Path traversal in parsedmarc 9.0.6 through 11.0.0 allows a network attacker who can send email to a monitored mailbox to write attacker-controlled files outside the intended samples directory. The flaw lives in save_output(), which names forensic failure report samples after the email Subject header but falls back to the raw unsanitized Subject when sanitization yields an empty string - which occurs whenever the Subject consists entirely of path separators or dots such as '../../../'. The attacker-supplied email body is then written as a dot-prefixed .eml file to an ancestor directory of the configured samples path. No public exploit identified at time of analysis; exploitation additionally requires the --output flag to be enabled.