CVE-2024-39929 - Vulnerability Details

Vendors	Products
Exim	Exim

Link	Providers
https://bugs.exim.org/show_bug.cgi?id=3099#c4
https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b
https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357
https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3
https://nvd.nist.gov/vuln/detail/CVE-2024-39929
https://www.cve.org/CVERecord?id=CVE-2024-39929
https://www.rfc-editor.org/rfc/rfc2231.txt

Type	Values Removed	Values Added
First Time appeared		Exim Exim exim
Weaknesses		CWE-116
CPEs		cpe:2.3:a:exim:exim::::::::
Vendors & Products		Exim Exim exim
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-39929", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-03-18T15:37:58.804Z", "dateReserved": "2024-07-04T00:00:00.000Z", "datePublished": "2024-07-04T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-07-04T14:47:11.317Z"}, "descriptions": [{"lang": "en", "value": "Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357"}, {"url": "https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b"}, {"url": "https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3"}, {"url": "https://www.rfc-editor.org/rfc/rfc2231.txt"}, {"url": "https://bugs.exim.org/show_bug.cgi?id=3099#c4"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-116", "lang": "en", "description": "CWE-116 Improper Encoding or Escaping of Output"}]}], "affected": [{"vendor": "exim", "product": "exim", "cpes": ["cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.97.1", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-08T16:09:08.280186Z", "id": "CVE-2024-39929", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-18T15:37:58.804Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:33:11.626Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357", "tags": ["x_transferred"]}, {"url": "https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b", "tags": ["x_transferred"]}, {"url": "https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3", "tags": ["x_transferred"]}, {"url": "https://www.rfc-editor.org/rfc/rfc2231.txt", "tags": ["x_transferred"]}, {"url": "https://bugs.exim.org/show_bug.cgi?id=3099#c4", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2024-39929 (string)

assignerOrgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

assignerShortName : mitre (string)

dateUpdated : 2025-03-18T15:37:58.804Z (string)

dateReserved : 2024-07-04T00:00:00.000Z (string)

datePublished : 2024-07-04T00:00:00.000Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

shortName : mitre (string)

dateUpdated : 2024-07-04T14:47:11.317Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users. (string)

}

]

affected : [ »

0 : { »

vendor : n/a (string)

product : n/a (string)

versions : [ »

0 : { »

version : n/a (string)

status : affected (string)

}

]

}

]

references : [ »

0 : { »

url : https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357 (string)

}

1 : { »

url : https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b (string)

}

2 : { »

url : https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3 (string)

}

3 : { »

url : https://www.rfc-editor.org/rfc/rfc2231.txt (string)

}

4 : { »

url : https://bugs.exim.org/show_bug.cgi?id=3099#c4 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : text (string)

lang : en (string)

description : n/a (string)

}

]

}

]

}

adp : [ »

0 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-116 (string)

lang : en (string)

description : CWE-116 Improper Encoding or Escaping of Output (string)

}

]

}

]

affected : [ »

0 : { »

vendor : exim (string)

product : exim (string)

cpes : [ »

0 : cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 4.97.1 (string)

versionType : custom (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 5.4 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : LOW (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-07-08T16:09:08.280186Z (string)

id : CVE-2024-39929 (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-18T15:37:58.804Z (string)

}

1 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T04:33:11.626Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3 (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://www.rfc-editor.org/rfc/rfc2231.txt (string)

tags : [ »

0 : x_transferred (string)

]

}

4 : { »

url : https://bugs.exim.org/show_bug.cgi?id=3099#c4 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357", "tags": ["x_transferred"]}, {"url": "https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b", "tags": ["x_transferred"]}, {"url": "https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3", "tags": ["x_transferred"]}, {"url": "https://www.rfc-editor.org/rfc/rfc2231.txt", "tags": ["x_transferred"]}, {"url": "https://bugs.exim.org/show_bug.cgi?id=3099#c4", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:33:11.626Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-39929", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-08T16:09:08.280186Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*"], "vendor": "exim", "product": "exim", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "4.97.1"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-08T16:10:49.707Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357"}, {"url": "https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b"}, {"url": "https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3"}, {"url": "https://www.rfc-editor.org/rfc/rfc2231.txt"}, {"url": "https://bugs.exim.org/show_bug.cgi?id=3099#c4"}], "descriptions": [{"lang": "en", "value": "Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-07-04T14:47:11.317Z"}}}, "cveMetadata": {"cveId": "CVE-2024-39929", "state": "PUBLISHED", "dateUpdated": "2025-03-18T15:37:58.804Z", "dateReserved": "2024-07-04T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-07-04T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3 (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://www.rfc-editor.org/rfc/rfc2231.txt (string)

tags : [ »

0 : x_transferred (string)

]

}

4 : { »

url : https://bugs.exim.org/show_bug.cgi?id=3099#c4 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T04:33:11.626Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 5.4 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : LOW (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-39929 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-07-08T16:09:08.280186Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:* (string)

]

vendor : exim (string)

product : exim (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 4.97.1 (string)

}

]

defaultStatus : unknown (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-116 (string)

description : CWE-116 Improper Encoding or Escaping of Output (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-07-08T16:10:49.707Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : n/a (string)

product : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

}

]

}

]

references : [ »

0 : { »

url : https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357 (string)

}

1 : { »

url : https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b (string)

}

2 : { »

url : https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3 (string)

}

3 : { »

url : https://www.rfc-editor.org/rfc/rfc2231.txt (string)

}

4 : { »

url : https://bugs.exim.org/show_bug.cgi?id=3099#c4 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : text (string)

description : n/a (string)

}

]

}

]

providerMetadata : { »

orgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

shortName : mitre (string)

dateUpdated : 2024-07-04T14:47:11.317Z (string)

}

cveMetadata : { »

cveId : CVE-2024-39929 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-18T15:37:58.804Z (string)

dateReserved : 2024-07-04T00:00:00.000Z (string)

assignerOrgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

datePublished : 2024-07-04T00:00:00.000Z (string)

assignerShortName : mitre (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users."}, {"lang": "es", "value": "Exim hasta la versi\u00f3n 4.97.1 analiza err\u00f3neamente un nombre de archivo de encabezado RFC 2231 multil\u00ednea y, por lo tanto, atacantes remotos pueden eludir un mecanismo de protecci\u00f3n de bloqueo de extensi\u00f3n $mime_filename y potencialmente entregar archivos adjuntos ejecutables a los buzones de correo de los usuarios finales."}], "id": "CVE-2024-39929", "lastModified": "2025-03-18T16:15:21.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-07-04T15:15:10.323", "references": [{"source": "cve@mitre.org", "url": "https://bugs.exim.org/show_bug.cgi?id=3099#c4"}, {"source": "cve@mitre.org", "url": "https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b"}, {"source": "cve@mitre.org", "url": "https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357"}, {"source": "cve@mitre.org", "url": "https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3"}, {"source": "cve@mitre.org", "url": "https://www.rfc-editor.org/rfc/rfc2231.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugs.exim.org/show_bug.cgi?id=3099#c4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.rfc-editor.org/rfc/rfc2231.txt"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users. (string)

}

1 : { »

lang : es (string)

value : Exim hasta la versión 4.97.1 analiza erróneamente un nombre de archivo de encabezado RFC 2231 multilínea y, por lo tanto, atacantes remotos pueden eludir un mecanismo de protección de bloqueo de extensión $mime_filename y potencialmente entregar archivos adjuntos ejecutables a los buzones de correo de los usuarios finales. (string)

}

]

id : CVE-2024-39929 (string)

lastModified : 2025-03-18T16:15:21.850 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.4 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.5 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2024-07-04T15:15:10.323 (string)

references : [ »

0 : { »

source : cve@mitre.org (string)

url : https://bugs.exim.org/show_bug.cgi?id=3099#c4 (string)

}

1 : { »

source : cve@mitre.org (string)

url : https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b (string)

}

2 : { »

source : cve@mitre.org (string)

url : https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357 (string)

}

3 : { »

source : cve@mitre.org (string)

url : https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3 (string)

}

4 : { »

source : cve@mitre.org (string)

url : https://www.rfc-editor.org/rfc/rfc2231.txt (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://bugs.exim.org/show_bug.cgi?id=3099#c4 (string)

}

6 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b (string)

}

7 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357 (string)

}

8 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3 (string)

}

9 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://www.rfc-editor.org/rfc/rfc2231.txt (string)

}

]

sourceIdentifier : cve@mitre.org (string)

vulnStatus : Awaiting Analysis (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-116 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Show plain JSON

{"bugzilla": {"description": "exim: exim: Incorrect parsing of multiline rfc2231 header filename", "id": "2295819", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295819"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-693", "details": ["Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users."], "name": "CVE-2024-39929", "public_date": "2024-07-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-39929\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-39929\nhttps://bugs.exim.org/show_bug.cgi?id=3099#c4\nhttps://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b\nhttps://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357\nhttps://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3\nhttps://www.rfc-editor.org/rfc/rfc2231.txt"], "statement": "Exim is not shipped in any Red Hat Offerings.", "threat_severity": "Important"}

{

bugzilla : { »

description : exim: exim: Incorrect parsing of multiline rfc2231 header filename (string)

id : 2295819 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2295819 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 3.7 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N (string)

status : draft (string)

}

cwe : CWE-693 (string)

details : [ »

0 : Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users. (string)

]

name : CVE-2024-39929 (string)

public_date : 2024-07-04T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2024-39929 https://nvd.nist.gov/vuln/detail/CVE-2024-39929 https://bugs.exim.org/show_bug.cgi?id=3099#c4 https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357 https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3 https://www.rfc-editor.org/rfc/rfc2231.txt (string)

]

statement : Exim is not shipped in any Red Hat Offerings. (string)

threat_severity : Important (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object