CVE-2024-39929 Security feature bypass in n/a
Remote attackers can bypass filename extension blocking in Exim by exploiting a parsing flaw, allowing delivery of executable attachments to user mailboxes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-39929?
CVE-2024-39929 is a medium-severity vulnerability in Exim Exim, published on 4 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.
Weakness: CWE-116
Which versions are affected by CVE-2024-39929?
It affects 1 product.
Linux distribution packages (3)
exim SUSE:Package Hub 15 SP5 | All versions | 4.97.1-bp155.5.12.1 |
exim openSUSE:Leap 15.5 | All versions | 4.97.1-bp155.5.12.1 |
exim openSUSE:Tumbleweed | All versions | 4.98-1.1 |
Products include Exim Exim.
How do I fix CVE-2024-39929?
Apply the vendor's patch.
Is CVE-2024-39929 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-39929 exists.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Exim Exim
Sources
Also known as CLEANSTART-2025-DU02255, CLSA-2024-1725550629, DEBIAN-CVE-2024-39929, DSA-5728-1, GHSA-7m4v-cwm7-4f2m, OESA-2024-2105 and 6 more.