PT-2024-4424 · Unknown+4 · Mime-Tools+4

Published 2024-03-18 · Updated 2024-06-11 · CVE-2024-28054

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Amavis versions 2.12.3 and earlier, Amavis versions 2.13.x before 2.13.1

Description The issue is related to an Interpretation Conflict when there are multiple boundary parameters in a MIME email message, which can lead to an incorrect check for banned files or malware. This is partly due to Amavis' use of MIME-tools. The conflict arises relative to some mail user agents.

Recommendations For Amavis versions 2.12.3 and earlier, update to version 2.12.3 or later. For Amavis versions 2.13.x before 2.13.1, update to version 2.13.1 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-436

Related Identifiers

BDU:2024-04924

CVE-2024-28054

MGASA-2024-0212

USN-6790-1

Affected Products

Amavis

Linuxmint

Mime-Tools

Red Os

Ubuntu

References · 29

• https://advisories.mageia.org/MGASA-2024-0212.html · Security Note
• https://osv.dev/vulnerability/USN-6790-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28054 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6790-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6J2MK2CS3KNJOS66QLW2MBJ4PIDLWJP5 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2024-28054 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28054 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0212 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-28054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28054 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-28054 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CDF6M3UXP45INVSWB4HXEDZH35CVZIJ4 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-28054 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/XQQQQPTZ5JHXTUCYUXZHY6RZJ6VOGOAJ · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04924 · Security Note