Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2017-2669

Published: 10 April 2017

Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.

Notes

AuthorNote
tyhicks
Vulnerable versions: 2.2.26 - 2.2.28

Priority

Medium

CVSS 3 base score: 7.5

Status

Package Release Status
dovecot
Launchpad, Ubuntu, Debian
upstream Needed

precise Not vulnerable

trusty Not vulnerable
(1:2.2.9-1ubuntu2.1)
xenial Not vulnerable

yakkety Not vulnerable
(1:2.2.24-1ubuntu1.3)
Patches:
upstream: https://github.com/dovecot/core/commit/000030feb7a30f193197f1aab8a7b04a26b42735