CVE-2024-28054

Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user ag...

Original description

The description as published by the source.

Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters in a MIME email message. Consequently, there can be an incorrect check for banned files or malware.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2024-28054 amavis Fixed in: 2.13.1-r0
Debian DEBIAN-CVE-2024-28054 amavisd-new Fixed in: 1:2.11.1-5+deb11u1

References

advisory github.com
advisory lists.fedoraproject.org
advisory lists.fedoraproject.org
advisory lists.fedoraproject.org
advisory nvd.nist.gov
report gitlab.com
web gitlab.com
web lists.amavis.org
web lists.fedoraproject.org
web lists.fedoraproject.org
web metacpan.org
web amavis.org