Vulnerability Description
A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dovecot | Dovecot | >= 2.0.0, <= 2.2.33 |
| Debian | Debian Linux | 7.0 |
| Canonical | Ubuntu Linux | 12.04 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1532768Issue TrackingPatchThird Party Advisory
- https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060.PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/03/msg00036.htmlMailing ListThird Party Advisory
- https://usn.ubuntu.com/3556-1/Third Party Advisory
- https://usn.ubuntu.com/3556-2/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4130Third Party Advisory
- https://www.dovecot.org/list/dovecot-news/2018-February/000370.htmlVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1532768Issue TrackingPatchThird Party Advisory
- https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060.PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/03/msg00036.htmlMailing ListThird Party Advisory
- https://usn.ubuntu.com/3556-1/Third Party Advisory
- https://usn.ubuntu.com/3556-2/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4130Third Party Advisory
- https://www.dovecot.org/list/dovecot-news/2018-February/000370.htmlVendor Advisory
FAQ
What is CVE-2017-15132?
CVE-2017-15132 is a vulnerability with a CVSS score of 7.5 (HIGH). A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performan...
How severe is CVE-2017-15132?
CVE-2017-15132 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-15132?
Check the references section above for vendor advisories and patch information. Affected products include: Dovecot Dovecot, Debian Debian Linux, Canonical Ubuntu Linux.