Homepage

CVE-2024-28054 Affecting amavisd-new package, versions <1:2.11.1-5+deb11u1

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.14% (36th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN11-AMAVISDNEW-6444566
  • published15 Mar 2024
  • disclosed18 Mar 2024
Report a new vulnerability Found a mistake?

Introduced: 15 Mar 2024

CVE-2024-28054  (opens in a new tab)

How to fix?

Upgrade Debian:11 amavisd-new to version 1:2.11.1-5+deb11u1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream amavisd-new package and not the amavisd-new package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters in a MIME email message. Consequently, there can be an incorrect check for banned files or malware.