{"id":"CVE-2024-28054","aliases":["ALPINE-CVE-2024-28054","DEBIAN-CVE-2024-28054","EUVD-2024-25222","GHSA-5hmm-p9xx-45x3","MGASA-2024-0212","UBUNTU-CVE-2024-28054","USN-6790-1"],"status":"published","title":"Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an...","description":"Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters in a MIME email message. Consequently, there can be an incorrect check for banned files or malware.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00826,"percentile":0.5771,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436"],"published":"2024-03-18T00:00:00Z","modified":"2026-11-02T12:01:29Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"amavis","fixed_in":["2.13.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"amavis","fixed_in":["2.13.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"amavis","fixed_in":["2.13.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"amavisd-new","fixed_in":["1:2.13.0-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"amavisd-new","fixed_in":["1:2.13.0-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"amavisd-new","fixed_in":["1:2.13.0-5"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"amavisd-new","fixed_in":["2.11.0-9.1.mga9"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"amavisd-new","fixed_in":["1:2.11.0-6.1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"amavisd-new","fixed_in":["1:2.12.2-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"amavisd-new","fixed_in":["1:2.13.0-3ubuntu2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"amavisd-new","fixed_in":["1:2.13.0-6ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"amavis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"amavis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"amavis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"amavisd-new","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.13.0-3+deb12u1"}]}],"versions":["1:2.13.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"amavisd-new","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.13.0-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"amavisd-new","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.13.0-5"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"amavisd-new","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-9.1.mga9"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"amavisd-new","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.7.1-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"amavisd-new","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.7.1-2ubuntu3","1:2.10.1-1ubuntu1","1:2.10.1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"amavisd-new","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10.1-4ubuntu1","1:2.11.0-1ubuntu1","1:2.11.0-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"amavisd-new","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11.0-6.1ubuntu1.1"}]}],"versions":["1:2.11.0-6.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"amavisd-new","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.12.2-1ubuntu1.1"}]}],"versions":["1:2.11.1-5ubuntu1","1:2.12.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"amavisd-new","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.13.0-3ubuntu2"}]}],"versions":["1:2.13.0-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"amavisd-new","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.13.0-6ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"amavisd-new","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11.0-6.1ubuntu1.1"}]}],"versions":["1:2.11.0-6.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"amavisd-new","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.12.2-1ubuntu1.1"}]}],"versions":["1:2.11.1-5ubuntu1","1:2.12.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"amavisd-new","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.13.0-3ubuntu2"}]}],"versions":["1:2.13.0-3ubuntu1"]}],"references":[{"url":"https://www.amavis.org/release-notes.txt","tags":["x_transferred","web","report"]},{"url":"https://metacpan.org/pod/MIME::Tools","tags":["x_transferred","web","report"]},{"url":"https://gitlab.com/amavis/amavis/-/issues/112","tags":["x_transferred","report"]},{"url":"https://gitlab.com/amavis/amavis/-/raw/v2.13.1/README_FILES/README.CVE-2024-28054","tags":["x_transferred","web","report"]},{"url":"https://lists.amavis.org/pipermail/amavis-users/2024-March/006811.html","tags":["x_transferred","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6J2MK2CS3KNJOS66QLW2MBJ4PIDLWJP5/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CDF6M3UXP45INVSWB4HXEDZH35CVZIJ4/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQQQQPTZ5JHXTUCYUXZHY6RZJ6VOGOAJ/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XQQQQPTZ5JHXTUCYUXZHY6RZJ6VOGOAJ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6J2MK2CS3KNJOS66QLW2MBJ4PIDLWJP5/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28054","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6J2MK2CS3KNJOS66QLW2MBJ4PIDLWJP5"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CDF6M3UXP45INVSWB4HXEDZH35CVZIJ4"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQQQQPTZ5JHXTUCYUXZHY6RZJ6VOGOAJ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XQQQQPTZ5JHXTUCYUXZHY6RZJ6VOGOAJ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6J2MK2CS3KNJOS66QLW2MBJ4PIDLWJP5"},{"url":"https://github.com/advisories/GHSA-5hmm-p9xx-45x3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-28054","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28054.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-28054","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0212.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33250","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6790-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-28054","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28054","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-28054","description":"Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters in a MIME email message. Consequently, there can be an incorrect check for banned files or malware.","status":"published","published":"2024-03-18T00:00:00Z","modified":"2025-11-04T22:06:05.674Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-25222","description":"Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters in a MIME email message. Consequently, there can be an incorrect check for banned files or malware.","status":"published","published":"2024-03-18T00:00:00Z","modified":"2025-11-04T22:06:05Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:20.707326Z"}],"ghsa":[{"id":"GHSA-5hmm-p9xx-45x3","title":"Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an...","description":"Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters in a MIME email message. Consequently, there can be an incorrect check for banned files or malware.","status":"published","published":"2024-03-18T18:32:19Z","modified":"2025-11-05T00:31:18Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:04:38.82847Z"}],"nvd":[{"id":"CVE-2024-28054","description":"Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters in a MIME email message. Consequently, there can be an incorrect check for banned files or malware.","status":"published","published":"2024-03-18T17:15:07.36Z","modified":"2026-06-17T07:20:52.86Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:09:41.654534Z"}],"osv":[{"id":"ALPINE-CVE-2024-28054","description":"Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters in a MIME email message. Consequently, there can be an incorrect check for banned files or malware.","status":"published","published":"2024-03-18T17:15:07.36Z","modified":"2026-11-02T11:17:50.083850385Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"CVE-2024-28054","description":"Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters in a MIME email message. Consequently, there can be an incorrect check for banned files or malware.","status":"published","published":"2024-03-18T00:00:00Z","modified":"2026-10-28T02:31:02.512067909Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"DEBIAN-CVE-2024-28054","description":"Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters in a MIME email message. Consequently, there can be an incorrect check for banned files or malware.","status":"published","published":"2024-03-18T17:15:07.36Z","modified":"2026-11-02T12:01:29.775627717Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"UBUNTU-CVE-2024-28054","description":"Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters in a MIME email message. Consequently, there can be an incorrect check for banned files or malware.","status":"published","published":"2024-03-18T17:15:00Z","modified":"2026-02-04T02:47:20.254601Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"MGASA-2024-0212","title":"Updated amavisd-new packages fix security vulnerability","description":"Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its\nuse of MIME-tools, has an Interpretation Conflict (relative to some mail\nuser agents) when there are multiple boundary parameters in a MIME email\nmessage. Consequently, there can be an incorrect check for banned files\nor malware. (CVE-2024-28054)\n","status":"published","published":"2024-06-06T15:48:22Z","modified":"2026-04-16T04:40:36.238327582Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"USN-6790-1","title":"amavisd-new vulnerability","description":"It was discovered that amavisd-new incorrectly handled certain MIME email\nmessages with multiple boundary parameters. A remote attacker could\npossibly use this issue to bypass checks for banned files or malware.\n","status":"published","published":"2024-05-28T11:24:30Z","modified":"2026-04-27T17:14:12.643676Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}