CVE-2017-15130

Published: Mar 2, 2018Modified: Nov 21, 2024

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.

Affected (6)

Products: Dovecot: Dovecot · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dovecot Dovecot	Before 2.2.34

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 17.10

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (14)

http://seclists.org/oss-sec/2018/q1/205

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1532356

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html

Source: secalert@redhat.com

https://usn.ubuntu.com/3587-1/

Source: secalert@redhat.com

Third Party Advisory

https://usn.ubuntu.com/3587-2/

Source: secalert@redhat.com

https://www.debian.org/security/2018/dsa-4130

Source: secalert@redhat.com

Third Party Advisory

https://www.dovecot.org/list/dovecot-news/2018-February/000370.html

Source: secalert@redhat.com

Release NotesVendor Advisory

http://seclists.org/oss-sec/2018/q1/205