CVE-2024-25584

Katalog CVE

CVSS 5.3 · Medium EPSS 0,19%

Kerentanan Insufficient Verification of Data Authenticity. Skor CVSS 3.1 5.3 (Medium) menurut open-xchange.com.

Deskripsi (NVD)

Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail with LF DOT LF in middle, into two emails when relaying to SMTP. Dovecot will split mail with LF DOT LF into two mails. Upgrade to latest released version. No publicly available exploits are known.

Rincian

Terbit di NVD

6 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber open-xchange.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2024/oxdc-adv-2024-0001.json