Homepage

Improper Input Validation Affecting dovecot package, versions <1:2.2.27-3

Severity

 Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
3.19% (91st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Input Validation vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-DEBIAN12-DOVECOT-1544465
  • published21 Jun 2018
  • disclosed21 Jun 2018
Report a new vulnerability Found a mistake?

Introduced: 21 Jun 2018

CVE-2017-2669  (opens in a new tab)
CWE-20  (opens in a new tab)

How to fix?

Upgrade Debian:12 dovecot to version 1:2.2.27-3 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream dovecot package and not the dovecot package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.