Open-Xchange Dovecot CVE-2024-25584 Email Splitting Vulnerability

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID: CVE-2024-25584 2. Vulnerability Description: Dovecot accepts LF DOT LF as the terminator for the DATA command. RFC requires it to be CR LF DOT CR LF. This causes Dovecot to split a single email into two emails when relaying to SMTP. 3. Affected Products: - OX Dovecot Pro core 2.3.21.1 - OX Dovecot Pro core 3.0.0 4. Discovery Date: 2023-12-28T09:14:31+01:00 5. Fix Date: - OXDC-CORE_2.3.21.1: 2024-05-08T08:19:02+02:00 - OXDC-CORE_3.0.0: 2024-05-08T08:19:02+02:00 6. Vulnerability Type: CWE-345, Insufficient Data Validation 7. Threat: - Impact: Dovecot splits emails containing LF DOT LF into two separate emails. - Exploit Status: No public exploits available. 8. Rating: - CVSS v3: 5.3, MEDIUM, NETWORK, LOW, NONE, NONE, NONE, NONE, NONE, NONE 9. Reference Links: - Canonical CSAF Document: https://documentation.open-xchange.com/dovecot/security/advisories/csafoxcadv2024-0001.json - Markdown Format: https://documentation.open-xchange.com/dovecot/security/advisories/md/2024/oxdc-adv-2024-0001.md - HTML Format: https://documentation.open-xchange.com/dovecot/security/advisories/html/2024/oxdc-adv-2024-0001.html - Plain-text Format: https://documentation.open-xchange.com/dovecot/security/advisories/txt/2024/oxdc-adv-2024-0001.txt This information helps understand the vulnerability details, affected products, discovery and fix timelines, severity rating, and related reference links.

Goal Reached Thanks to every supporter — we hit 100%!

Open-Xchange Dovecot CVE-2024-25584 Email Splitting Vulnerability