CVE-2024-49393

In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality...

The vulnerability of the JetBrains YouTrac project management and task management software is related to the use of a regular expression with inefficient computational complexity, which can lead to service failures.

The vulnerability of the YouTrack Helpdesk service relates to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability allows an attacker who operates remotely to trigger a service failure by parsing email headers within the Helpdesk functionality...

PT-2024-7560

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2024.3.47707 Description The issue is related to the Helpdesk function in YouTrack, which uses a regular expression with inefficient computational complexity. This could allow a remote attacker to cause a...

ROS-20241021-04

A vulnerability in the Dovecot mail server is related to the fact that the application does not control the consumption of internal resources properly when parsing too large email headers. internal resources properly when parsing excessively large email headers. Exploitation of the vulnerability...

cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection

A vulnerability was found in the email module that uses Python language. The email module doesn't properly quote new lines in email headers. This flaw allows an attacker to inject email headers that could, among other possibilities, add hidden email destinations or inject content into the email,...

PT-2024-10072

Name of the Vulnerable Software and Affected Versions Mutt and NeoMutt affected versions not specified Description The issue is related to errors in cryptographic signature verification when processing header fields. This allows a remote attacker to modify the list of trusted recipients and...

cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection

A vulnerability was found in the email module that uses Python language. The email module doesn't properly quote new lines in email headers. This flaw allows an attacker to inject email headers that could, among other possibilities, add hidden email destinations or inject content into the email,...

dovecot: using a large number of address headers may trigger a denial of service

A flaw was found in Dovecot. Processing a large number of address headers From, To, Cc, Bcc, etc can be excessively CPU intensive. This flaw allows a remote attacker to trigger a denial of service...

cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection

A vulnerability was found in the email module that uses Python language. The email module doesn't properly quote new lines in email headers. This flaw allows an attacker to inject email headers that could, among other possibilities, add hidden email destinations or inject content into the email,...

CVE-2024-23184

Having a large number of address headers From, To, Cc, Bcc, etc. becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors...

Fedora: Security Advisory (FEDORA-2024-ba5bb9f63a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-e23e8a3f1e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ROS-20240905-02

A vulnerability in the Python programming language interpreter CPython is related to incorrectly enclosing newline characters in quotation marks for email headers when serializing a message. newline quotes for email headers when serializing a message. Exploitation vulnerability could allow an...

RHEL 9 : python3.9 (RHSA-2024:6163)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6163 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Fedora 39 : dovecot (2024-ba5bb9f63a)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-ba5bb9f63a advisory. - CVE-2024-23184: A large number of address headers in email resulted in excessive CPU usage. - CVE-2024-23185: Abnormally large email headers are n...

Fedora 40 : dovecot (2024-e23e8a3f1e)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e23e8a3f1e advisory. - CVE-2024-23184: A large number of address headers in email resulted in excessive CPU usage. - CVE-2024-23185: Abnormally large email headers are n...

Mageia: Security Advisory (MGASA-2024-0280)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2024-0280 Updated packages fix security vulnerabilities

CVE-2024-23184: A large number of address headers in email resulted in excessive CPU usage. CVE-2024-23185: Abnormally large email headers are now truncated or discarded, with a limit of 10MB on a single header and 50MB for all the headers of all the parts of an email...

Updated packages fix security vulnerabilities

CVE-2024-23184: A large number of address headers in email resulted in excessive CPU usage. CVE-2024-23185: Abnormally large email headers are now truncated or discarded, with a limit of 10MB on a single header and 50MB for all the headers of all the parts of an email...

FreeBSD : Dovecot -- DoS (6a6ad6cb-5c6c-11ef-b456-001e676bf734)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6a6ad6cb-5c6c-11ef-b456-001e676bf734 advisory. Dovecot reports: A DoS is possible with a large number of address headers or abnormally large...