CVE-2024-25584

What it actually does

The vulnerability allows Dovecot to incorrectly interpret LF DOT LF as the end of an email DATA command, instead of the required CR LF DOT CR LF sequence, resulting in a single email being split into multiple emails during SMTP relaying.

Why it matters to the business

This can lead to email messages being unexpectedly split, potentially causing delivery of partial or unauthorized content, which may disrupt email communications and introduce risks in mail server operations.

How an attack unfolds

An attacker crafts an email containing an LF DOT LF sequence in the middle of the message body and sends it through the Dovecot server, causing the server to treat it as two separate emails when forwarding via SMTP.

How to fix it

Upgrade Dovecot to the latest released version that properly enforces the CR LF DOT CR LF termination sequence.

How to confirm the fix worked

Verify the installed Dovecot version against the patched release and test email handling with messages containing LF DOT LF sequences to ensure they are not split.

Typical attack path

1. Craft email with embedded LF DOT LF sequence
2. Submit email to Dovecot for processing
3. Observe server splitting the email into two separate messages during relay

How to detect it

Monitor email server logs for instances where single incoming messages result in multiple outgoing relays, and inspect message bodies for unexpected LF DOT LF patterns.

What your security team should do

• Upgrade Dovecot to the latest version immediately
• Review email logs for any signs of unexpected message splitting
• Implement input validation on email content if possible