mailing list archives
Re: CVE request: Dovecot DoS in 2.x (fixed in 2.1.11)
From: Vincent Danen <vdanen () redhat com>
Date: Tue, 4 Dec 2012 15:48:21 -0700
* [2012-12-04 23:01:42 +0100] Moritz Muehlenhoff wrote:
On Tue, Dec 04, 2012 at 06:12:29PM +0100, Matthias Weckbecker wrote:
Hi Kurt, Vincent, vendors, ...
Quoting Kurt Seifried <kseifried () redhat com>:
>-----BEGIN PGP SIGNED MESSAGE-----
>On 12/03/2012 10:33 AM, Vincent Danen wrote:
>>Could a CVE be assigned for the following please?
>>Dovecot 2.1.11 was released and includes a fix for a crash
>>condition when the IMAP server was issued a SEARCH command with
>>multiple KEYWORD parameters. An authenticated remote user could
>>use this flaw to crash Dovecot.
>Please use CVE-2012-5620 for this issue.
We were discussing this issue too at  and think that it does only
affect the current connection, no subsequent (i.e. new) connections
What's your opinion wrt this?
Upstream (Timo Sirainen) disputed the issue in the Debian BTS:
Ahhh... yes, Timo is correct. If you're only DoS'ing your own
connection, I wouldn't consider this a flaw.
I (mistakenly) thought this took down the entire dovecot server. My
Can we have this CVE rejected or disputed? As Timo says, it's a
Thanks, and sorry about that.
Vincent Danen / Red Hat Security Response Team