oxdc-adv-2024-0001

{
  "document": {
    "aggregate_severity": {
      "text": "MEDIUM"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "GREEN",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "name": "Open-Xchange GmbH",
      "namespace": "https://open-xchange.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical CSAF document",
        "url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2024/oxdc-adv-2024-0001.json"
      },
      {
        "category": "self",
        "summary": "Markdown representation",
        "url": "https://documentation.open-xchange.com/dovecot/security/advisories/md/2024/oxdc-adv-2024-0001.md"
      },
      {
        "category": "self",
        "summary": "HTML representation",
        "url": "https://documentation.open-xchange.com/dovecot/security/advisories/html/2024/oxdc-adv-2024-0001.html"
      },
      {
        "category": "self",
        "summary": "Plain-text representation",
        "url": "https://documentation.open-xchange.com/dovecot/security/advisories/txt/2024/oxdc-adv-2024-0001.txt"
      }
    ],
    "title": "OX Dovecot Pro Security Advisory OXDC-ADV-2024-0001",
    "tracking": {
      "current_release_date": "2024-09-06T00:00:00+00:00",
      "generator": {
        "date": "2024-09-06T15:13:30+00:00",
        "engine": {
          "name": "OX CSAF",
          "version": "1.0.0"
        }
      },
      "id": "OXDC-ADV-2024-0001",
      "initial_release_date": "2024-09-02T00:00:00+02:00",
      "revision_history": [
        {
          "date": "2024-09-02T00:00:00+02:00",
          "number": "1",
          "summary": "Initial release"
        },
        {
          "date": "2024-09-06T00:00:00+00:00",
          "number": "2",
          "summary": "Public release"
        },
        {
          "date": "2024-09-06T00:00:00+00:00",
          "number": "3",
          "summary": "Public release"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.3.21.1",
                "product": {
                  "name": "OX Dovecot Pro core 2.3.21.1",
                  "product_id": "OXDC-CORE_2.3.21.1",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:dovecot:2.3.21.1:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "3.0.0",
                "product": {
                  "name": "OX Dovecot Pro core 3.0.0",
                  "product_id": "OXDC-CORE_3.0.0",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:dovecot:3.0.0:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX Dovecot Pro core"
          }
        ],
        "category": "vendor",
        "name": "Open-Xchange GmbH"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Hanno Böck <hanno@hboeck.de>"
          ]
        }
      ],
      "cve": "CVE-2024-25584",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2023-12-28T09:14:31+01:00",
      "ids": [
        {
          "system_name": "JIRA OX Bug",
          "text": "DOV-6394"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail with LF DOT LF in middle, into two emails when relaying to SMTP."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXDC-CORE_3.0.0"
        ],
        "last_affected": [
          "OXDC-CORE_2.3.21.1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-05-08T08:19:02+02:00",
          "details": "Upgrade to latest released version.",
          "product_ids": [
            "OXDC-CORE_2.3.21.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXDC-CORE_2.3.21.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Dovecot will split mail with LF DOT LF into two mails."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": " SMTP/Submission server accepts bad <LF>.<LF> end of data symbol (SMTP Smuggling)"
    }
  ]
}