Debian Security Advisory DSA 3828-1 (dovecot - security update)

It was discovered that the Dovecot email server is vulnerable to a denial of service attack. When the dict passdb and userdb are used for user authentication, the username sent by the IMAP/POP3 client is sent through varexpand to perform %variable expansion. Sending specially crafted %variable...

PT-2017-15466

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.2.29 Description The issue allows for a denial of service when 'dict' passdb and userdb are used for user authentication. By sending specially crafted %variable fields, an attacker can cause excessive memory usage,...

CVE-2017-2669

Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through varexpand to perform %variable expansion. Sending specially crafted %variable fields could result in...

UBUNTU-CVE-2017-2669

Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through varexpand to perform %variable expansion. Sending specially crafted %variable fields could result in...

DSA-3828-1 dovecot - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3828-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Open-Xchange: Dovecot authentication is vulnerable to timing attacks.

Dear Dovecot bug bounty team, Dovecot is vulnerable to timing attacks, because the verifycredentials function in CRAM-MD5 performs a byte-by-byte comparison, which terminates early when two characters do not match. Summary --- Timing attacks are a type of side channel attack where one can discove...

CVE-2016-8652

The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service crash by aborting authentication without setting a username...

CVE-2016-8652

The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service crash by aborting authentication without setting a username...

DEBIAN-CVE-2016-8652

The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service crash by aborting authentication without setting a username...

Authentication flaw

The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service crash by aborting authentication without setting a username...

CVE-2016-8652

The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service crash by aborting authentication without setting a username...

CVE-2016-8652: Improper Input Validation

The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service crash by aborting authentication without setting a username...

EUVD-2016-9491

The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service crash by aborting authentication without setting a username...

CVE-2016-8652

The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service crash by aborting authentication without setting a username...

CVE-2016-8652

The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service crash by aborting authentication without setting a username...

CVE-2016-8652

The CVE-2016-8652 affects the Dovecot auth component when the auth-policy is enabled. The vulnerability allows a remote attacker to cause a denial-of-service (crash) by aborting authentication without a username, with affected versions listed as Dovecot prior to 2.2.27 (OpenVAS references note a ...

CVE-2016-8652

The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service crash by aborting authentication without setting a username...

PT-2017-9716

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.2.27 Description The issue allows remote attackers to cause a denial of service by aborting authentication without setting a username when the auth-policy is configured in the auth component. Recommendations For...

Fedora Update for dovecot FEDORA-2016-daf90926d4

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...