Lucene search

K
slackwareSlackware Linux ProjectSSA-2024-227-01
HistoryAug 14, 2024 - 7:37 p.m.

[slackware-security] dovecot

2024-08-1419:37:56
Slackware Linux Project
www.slackware.com
2
dovecot
slackware
security fix
cpu usage
email headers
upgrade
installation.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

Low

EPSS

0

Percentile

9.6%

New dovecot packages are available for Slackware 15.0 and -current to
fix security issues.

Here are the details from the Slackware 15.0 ChangeLog:

patches/packages/dovecot-2.3.21.1-i586-1_slack15.0.txz: Upgraded.
This update fixes security issues:
A large number of address headers in email resulted in excessive CPU usage.
Abnormally large email headers are now truncated or discarded, with a limit
of 10MB on a single header and 50MB for all the headers of all the parts of
an email.
For more information, see:
https://vulners.com/cve/CVE-2024-23184
https://vulners.com/cve/CVE-2024-23185
(* Security fix *)

Where to find the new packages:

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/dovecot-2.3.21.1-i586-1_slack15.0.txz

Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/dovecot-2.3.21.1-x86_64-1_slack15.0.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/dovecot-2.3.21.1-i686-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/dovecot-2.3.21.1-x86_64-1.txz

MD5 signatures:

Slackware 15.0 package:
d794276c3fd3027c6359588acd4194b4 dovecot-2.3.21.1-i586-1_slack15.0.txz

Slackware x86_64 15.0 package:
234a9dd6ab876a5a042f0e0e023c30d7 dovecot-2.3.21.1-x86_64-1_slack15.0.txz

Slackware -current package:
7d07927ffafb070680e2c6a8a3ad337b n/dovecot-2.3.21.1-i686-1.txz

Slackware x86_64 -current package:
c47edd47c6911715760cc7e65e8d1753 n/dovecot-2.3.21.1-x86_64-1.txz

Installation instructions:

Upgrade the package as root:
> upgradepkg dovecot-2.3.21.1-i586-1_slack15.0.txz

Then restart Dovecot if you are using it:
> sh /etc/rc.d/rc.dovecot restart

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

Low

EPSS

0

Percentile

9.6%