Vulnerability Description
A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dovecot | Dovecot | < 2.2.34 |
| Debian | Debian Linux | 8.0 |
| Canonical | Ubuntu Linux | 14.04 |
Related Weaknesses (CWE)
References
- http://seclists.org/oss-sec/2018/q1/205Mailing ListThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1532356Issue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html
- https://usn.ubuntu.com/3587-1/Third Party Advisory
- https://usn.ubuntu.com/3587-2/
- https://www.debian.org/security/2018/dsa-4130Third Party Advisory
- https://www.dovecot.org/list/dovecot-news/2018-February/000370.htmlRelease NotesVendor Advisory
- http://seclists.org/oss-sec/2018/q1/205Mailing ListThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1532356Issue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html
- https://usn.ubuntu.com/3587-1/Third Party Advisory
- https://usn.ubuntu.com/3587-2/
- https://www.debian.org/security/2018/dsa-4130Third Party Advisory
- https://www.dovecot.org/list/dovecot-news/2018-February/000370.htmlRelease NotesVendor Advisory
FAQ
What is CVE-2017-15130?
CVE-2017-15130 is a vulnerability with a CVSS score of 5.9 (MEDIUM). A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the...
How severe is CVE-2017-15130?
CVE-2017-15130 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-15130?
Check the references section above for vendor advisories and patch information. Affected products include: Dovecot Dovecot, Debian Debian Linux, Canonical Ubuntu Linux.