CVE-2024-28054

What it actually does

Amavis performs an incorrect MIME boundary check on messages containing multiple boundary parameters, allowing a mismatch between its parser (influenced by MIME-tools) and downstream mail user agents that results in skipped banned-file and malware inspections.

Why it matters to the business

Malicious or policy-violating attachments can reach end users undetected, raising the likelihood of malware execution and data incidents in mail environments that rely on Amavis for content filtering.

How an attack unfolds

An attacker crafts a MIME message with duplicate boundary parameters that Amavis interprets differently from the recipient MUA; the message passes Amavis scanning but is rendered with the malicious part intact by the client, bypassing all content checks.

How to fix it

Upgrade Amavis to 2.12.3 or later, or 2.13.1 or later. For AlmaLinux 8 deployments, update setroubleshoot and setroubleshoot-server to 3.3.24-4.el8. Apply the Amavis GIT commit 3290c9c2a11a8cc9595b5810b2f86c1dac25a392 where available. Rebuild any local packages that embed vulnerable Amavis code.

How to confirm the fix worked

Verify installed package versions match or exceed the listed fixed releases; replay test messages containing duplicate MIME boundaries through the updated scanner and confirm both parts are now inspected.

Typical attack path

1. Generate a MIME email containing multiple boundary parameters where one part holds banned or malicious content.
2. Send the message through an MTA that routes it to Amavis for scanning.
3. Amavis accepts the message because its boundary parsing skips the malicious part.
4. The recipient MUA renders the message using the alternate boundary, exposing the harmful attachment.

How to detect it

Search MTA and Amavis logs for deliveries of messages whose MIME structure contains repeated boundary parameters; correlate with any post-delivery malware alerts or user reports of unexpected attachments.

What your security team should do

• Immediately schedule upgrades to the fixed Amavis versions in all mail-filtering gateways.
• Add version checks for amavis, setroubleshoot, and setroubleshoot-server to existing patch-compliance dashboards.
• Review mail logs for any historical messages that may have bypassed content filters before the upgrade.
• Consider additional boundary-normalization rules in upstream MTAs until patching is complete.