CVE-2017-2669 — Improper Input Validation in Dovecot

CWE-20 — Improper Input Validation10 documents7 sources
Severity
7.5HIGHNVD
EPSS
6.9%
top 8.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
DovecotDebian DovecotDebian Linux
Timeline
PublishedJun 21
Latest updateMay 13

Description

Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/dovecot< dovecot 1:2.2.27-3 (bookworm)
▶Debiandovecot/dovecot< 1:2.2.27-3+3
▶NVDdovecot/dovecot2.2.26 — 2.2.28

Also affects: Debian Linux 8.0

🔴Vulnerability Details

2
GHSA
GHSA-qchv-9m57-q82h: Dovecot before version 2↗2022-05-13
▶
OSV
CVE-2017-2669: Dovecot before version 2↗2018-06-21
▶

📋Vendor Advisories

4
Ubuntu
Dovecot regression↗2017-04-11
▶
Red Hat
dovecot: Dovecot DoS when passdb dict was used for authentication↗2017-04-10
▶
Ubuntu
Dovecot vulnerability↗2017-04-10
▶
Debian
CVE-2017-2669: dovecot - Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' ...↗2017
▶

💬Community

3
Bugzilla
CVE-2017-14063 async-http-client: Invalid URL parsing with '?'↗2017-09-01
▶
Bugzilla
CVE-2017-2669 dovecot: Dovecot DoS when passdb dict was used for authentication [fedora-all]↗2017-04-12
▶
Bugzilla
CVE-2017-2669 dovecot: Dovecot DoS when passdb dict was used for authentication↗2017-04-04
▶