CVEvulnerability
CVE-2017-15130
5.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-03-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.9 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-400
Description
A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.
Affected configurations
• dovecot dovecot (< 2.2.34)
• debian debian linux 8.0
• debian debian linux 9.0
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 17.10
Related
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- http://seclists.org/oss-sec/2018/q1/205 Mailing List, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1532356 Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html lists.debian.org
- https://usn.ubuntu.com/3587-1/ Third Party Advisory
- https://usn.ubuntu.com/3587-2/ usn.ubuntu.com
- https://www.debian.org/security/2018/dsa-4130 Third Party Advisory
- https://www.dovecot.org/list/dovecot-news/2018-February/000370.html Release Notes, Vendor Advisory
- http://seclists.org/oss-sec/2018/q1/205 Mailing List, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1532356 Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html lists.debian.org
- https://usn.ubuntu.com/3587-1/ Third Party Advisory
- https://usn.ubuntu.com/3587-2/ usn.ubuntu.com
- https://www.debian.org/security/2018/dsa-4130 Third Party Advisory
- https://www.dovecot.org/list/dovecot-news/2018-February/000370.html Release Notes, Vendor Advisory