GHSA-gmc6-fwg3-75m5 Mimekit has vulnerable dependency that can lead to denial of service
A vulnerable dependency in MimeKit allows attackers to cause denial of service when processing S/MIME messages or X.509 certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-gmc6-fwg3-75m5?
GHSA-gmc6-fwg3-75m5 is a denial of service vulnerability in MimeKit, published on 11 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
Denial of service vulnerability.
Details
See: https://github.com/advisories/GHSA-447r-wph3-92pm and https://github.com/dotnet/announcements/issues/312
PoC
Update System.Security.Cryptography.Pkcs to 8.0.1 so that the transitive dependency with the issue gets updated
Impact
Denial of service vulnerability. Affects MimeKit (>= v3.0.0 and <= v4.7.0) when used to decrypt or verify incoming S/MIME messages as well as importing 3rd-party X.509 certificates for use with encrypting outgoing S/MIME messages.
Which versions are affected by GHSA-gmc6-fwg3-75m5?
2 open source packages ship an affected version, including MimeKit.
| Package | Affected | Fixed in |
|---|---|---|
MimeKit NuGet | From 3.0.0 | 4.7.1 |
MimeKit NuGet | From 3.0.0 | 4.7.1 |
How do I fix GHSA-gmc6-fwg3-75m5?
Upgrade MimeKit to 4.7.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-gmc6-fwg3-75m5 being exploited?
There is no known exploitation of GHSA-gmc6-fwg3-75m5 in the wild and no public exploit code.