CVE-2024-23185

CVE-2024-23185 details (normal mode) : Dovecot is reported to be vulnerable to resource exhaustion due to very large email headers. The root cause is an unbounded full_value buffer in the message-header-parser when feeding large or split headers, leading to high memory usage. This issue affects D...

CVE-2024-23184

CVE-2024-23184 affects the Dovecot IMAP/POP3 server. The root issue is that parsing a large number of email address headers (From, To, Cc, Bcc, etc.) is highly CPU-intensive, leading to potential denial of service when attackers send crafted messages that trigger resource exhaustion. The availabl...

CVE-2024-23184

Having a large number of address headers From, To, Cc, Bcc, etc. becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors...

CVE-2024-23184

Having a large number of address headers From, To, Cc, Bcc, etc. becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors...

Moderate: Red Hat Security Advisory: dovecot security update

An update for dovecot is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

dovecot: very large headers can cause resource exhaustion when parsing message

A security issue was found in Dovecot. Very large headers can lead to resource exhaustion when parsing messages. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to the message-header-parser, it starts building up a "fullvalue" buffer out of th...

dovecot: using a large number of address headers may trigger a denial of service

A flaw was found in Dovecot. Processing a large number of address headers From, To, Cc, Bcc, etc can be excessively CPU intensive. This flaw allows a remote attacker to trigger a denial of service...

SUSE CVE-2024-25584

Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail with LF DOT LF in middle, into two emails when relaying to SMTP. Dovecot will split mail with LF DOT LF into two mails. Upgrade to latest...

ALSA-2024:6529 Moderate: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...

Moderate: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...

Fedora: Security Advisory (FEDORA-2024-ba5bb9f63a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Open-Xchange Dovecot 安全漏洞

Open-Xchange Dovecot is an open source mail server from the German company Open-Xchange. A security vulnerability exists in Open-Xchange Dovecot that originates from an external attacker who can send specially crafted messages to consume target system resources and cause an interruption...

Open-Xchange Dovecot 安全漏洞

Open-Xchange Dovecot is an open source mail server from the German company Open-Xchange. A security vulnerability exists in Open-Xchange Dovecot that stems from parsing messages with very large headers that can lead to resource exhaustion...

dovecot security update

1:2.3.16-11.1 - fix CVE-2024-23184: using a large number of address headers may trigger a denial of service RHEL-55211 - fix CVE-2024-23185: very large headers can cause resource exhaustion when parsing message RHEL-55225...

Fedora: Security Advisory (FEDORA-2024-e23e8a3f1e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 9 : dovecot (RHSA-2024:6529)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6529 advisory. Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3...

Oracle Linux 9 : dovecot (ELSA-2024-6529)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-6529 advisory. - fix CVE-2024-23184: using a large number of address headers may trigger a denial of service RHEL-55211 Tenable has extracted the preceding descriptio...

dovecot: using a large number of address headers may trigger a denial of service

A flaw was found in Dovecot. Processing a large number of address headers From, To, Cc, Bcc, etc can be excessively CPU intensive. This flaw allows a remote attacker to trigger a denial of service...

Moderate: Red Hat Security Advisory: dovecot security update

An update for dovecot is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

dovecot: very large headers can cause resource exhaustion when parsing message

A security issue was found in Dovecot. Very large headers can lead to resource exhaustion when parsing messages. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to the message-header-parser, it starts building up a "fullvalue" buffer out of th...