PT-2024-40304 · Unknown+1 · System.Security.Cryptography.Pkcs+1

Published 2024-07-11 · Updated 2024-07-11

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MimeKit versions 3.0.0 through 4.7.0

Description The issue is a denial of service vulnerability. It affects the handling of S/MIME messages and the import of X.509 certificates.

Recommendations For MimeKit versions 3.0.0 through 4.7.0, update System.Security.Cryptography.Pkcs to 8.0.1 to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

GHSA-GMC6-FWG3-75M5

Affected Products

Mimekit

System.Security.Cryptography.Pkcs

References · 6

• https://osv.dev/vulnerability/GHSA-gmc6-fwg3-75m5 · Vendor Advisory
• https://github.com/jstedfast/MimeKit · Note
• https://github.com/jstedfast/MimeKit/security/advisories/GHSA-gmc6-fwg3-75m5 · Note
• https://github.com/jstedfast/MimeKit/commit/aef4eda75525848b992ce5e1f9b87399000fffb6 · Note
• https://github.com/dotnet/announcements/issues/312 · Note
• https://github.com/advisories/GHSA-447r-wph3-92pm · Note