CVE-2014-3430

Published: 13 May 2014

Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows remote attackers to cause a denial of service (resource consumption) via an incomplete SSL/TLS handshake for an IMAP/POP3 connection.

Priority

Medium

Status

Package Release Status
dovecot
Launchpad, Ubuntu, Debian
Upstream
Released (1:2.2.13~rc1-1)
Ubuntu 14.04 ESM (Trusty Tahr)
Released (1:2.2.9-1ubuntu2.1)
Patches:
Upstream: http://hg.dovecot.org/dovecot-2.2/rev/41622541a7a3
Upstream: http://hg.dovecot.org/dovecot-2.1/rev/b7ac23b4d339
Upstream: http://hg.dovecot.org/dovecot-2.0/rev/48f90e7e92dc
Upstream: http://hg.dovecot.org/dovecot-1.2/rev/8ba4253adc9b