Security Advisory

CVE-2017-2669

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2018-06-21 13:00:00

Last updated 2024-08-05 14:02:06

Assigner redhat

State PUBLISHED

Description

Dovecot before version 2.2.29 is vulnerable to a denial of service. When dict passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.

← Browse all CVEs View on cve.org ↗