CVE-2024-25584 MEDIUM

CVE-2024-25584

Vendor Open-Xchange Gmbh
Product OX Dovecot Pro
Weakness CWE-345
Published September 6, 2024
Last update September 6, 2024

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail with LF DOT LF in middle, into two emails when relaying to SMTP. Dovecot will split mail with LF DOT LF into two mails. Upgrade to latest released version. No publicly available exploits are known.

Key dates

02Disclosure timeline

September 6, 2024 CVE published
September 6, 2024 Record updated