mailing list archives
Re: CVE request: Dovecot DoS in 2.x (fixed in 2.1.11)
From: Kurt Seifried <kseifried () redhat com>
Date: Tue, 04 Dec 2012 21:29:17 -0700
-----BEGIN PGP SIGNED MESSAGE-----
On 12/04/2012 03:48 PM, Vincent Danen wrote:
* [2012-12-04 23:01:42 +0100] Moritz Muehlenhoff wrote:
On Tue, Dec 04, 2012 at 06:12:29PM +0100, Matthias Weckbecker
Hi Kurt, Vincent, vendors, ...
Quoting Kurt Seifried <kseifried () redhat com>:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 12/03/2012 10:33 AM, Vincent Danen wrote:
Could a CVE be assigned for the following please?
Dovecot 2.1.11 was released and includes a fix for a crash
condition when the IMAP server was issued a SEARCH command
with multiple KEYWORD parameters. An authenticated remote
user could use this flaw to crash Dovecot.
Please use CVE-2012-5620 for this issue.
We were discussing this issue too at  and think that it does
only affect the current connection, no subsequent (i.e. new)
connections are affected.
What's your opinion wrt this?
Upstream (Timo Sirainen) disputed the issue in the Debian BTS:
Ahhh... yes, Timo is correct. If you're only DoS'ing your own
connection, I wouldn't consider this a flaw.
I (mistakenly) thought this took down the entire dovecot server.
Can we have this CVE rejected or disputed? As Timo says, it's a
Thanks, and sorry about that.
Please REJECT CVE-2012-5620, this only affects the users session and
thus no security boundary is crossed (users can of course always close
their own session, and there is no way to trigger the client to do
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
-----END PGP SIGNATURE-----