PT-2024-36555 · Unknown · Mailcleaner

Published 2024-12-08 · Updated 2024-12-12 · CVE-2024-55560

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MailCleaner versions before 28d913e

Description The issue concerns default values of ssh host dsa key, ssh host rsa key, and ssh host ed25519 key that persist after installation.

Recommendations For versions before 28d913e, update to a version after 28d913e to resolve the issue. As a temporary workaround, consider regenerating the ssh host dsa key, ssh host rsa key, and ssh host ed25519 key to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2024-55560

Affected Products

Mailcleaner

References · 10

• https://osv.dev/vulnerability/CVE-2024-55560 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55560 · Security Note
• https://github.com/MailCleaner/MailCleaner/wiki/Watchdogs#host_keys · Note
• https://github.com/MailCleaner/MailCleaner/commit/28d913eaa044b689eb114f72ebe92d48cb4aaca7 · Note
• https://twitter.com/CVEnew/status/1865897590132187253 · Twitter Post
• https://mailcleaner.net/infobox/mc-info-box.php · Note
• https://t.me/cvenotify/103552 · Telegram Post
• https://twitter.com/cracbot/status/1867087075834728853 · Twitter Post
• https://t.me/cvenotify/103478 · Telegram Post
• https://t.me/cvedetector/12333 · Telegram Post