CVE-2020-12063
mediumpriority · track · 21EPSS 0.009 · 61 %ileEUUSEPSS · scored 2026-10-28
A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demonstrated by the similarity of \xce\xbf to the 'o' character. This is potentially relevant when the /etc/postfix/sender_login feature is used, because a spoofed outbound message that uses a configured sender address is blocked with a "Sender address rejected: not logged in" error message, but a spoofed outbound message that uses a homoglyph of a configured sender address is not blocked. NOTE: some third parties argue that any missed blocking of spoofed outbound messages - except for exact matches to a sender address in the /etc/postfix/sender_login file - is outside the design goals of Postfix and thus cannot be considered a Postfix vulnerability
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://nvd.nist.gov/vuln/detail/CVE-2020-12063cnnvd
- https://www.openwall.com/lists/oss-security/2020/04/23/12cnnvd
- https://www.openwall.com/lists/oss-security/2020/04/23/3cnnvd
- https://www.openwall.com/lists/oss-security/2020/04/23/12enisa_euvd
- https://www.openwall.com/lists/oss-security/2020/04/23/3enisa_euvd
- https://www.openwall.com/lists/oss-security/2020/04/23/12ExploitMailing ListThird Party Advisorynvd
- https://www.openwall.com/lists/oss-security/2020/04/23/3Mailing ListThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan