Affected product: Dovecot IMAP Server
Internal reference: DOV-6601
Vulnerability type: CWE-770 (Allocation of Resources Without Limits or Throttling)
Vulnerable version: 2.2, 2.3
Vulnerable component: lib-mail
Report confidence: Confirmed
Solution status: Fixed in 2.3.21.1
Researcher credits: Vendor internal discovery
Vendor notification: 2024-01-31
CVE reference: CVE-2024-23185
CVSS: 7.5 (CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:H)<\/p>\n
Vulnerability Details:
Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up “full_value” buffer out of the smaller chunks. The full_value buffer has no size limit, so large headers can cause large memory usage. It doesn’t matter whether it’s a single long header line, or a single header split into multiple lines. This bug exists in all Dovecot versions.<\/p>\n
Incoming mails typically have some size limits set by MTA, so even largest possible header size may still fit into Dovecot’s vsz_limit. So attackers probably can’t DoS a victim user this way. A user could APPEND larger mails though, allowing them to DoS themselves (although maybe cause some memory issues for the backend in general).<\/p>\n
Workaround:
One can implement restrictions on headers on MTA component preceding Dovecot.<\/p>\n
Fix:
Install non-vulnerable version of Dovecot. Patch can be found at https:\/\/github.com\/dovecot\/core\/compare\/f020e13%5E…ce88c33.patch<\/p>\n","protected":false},"excerpt":{"rendered":"
Affected product: Dovecot IMAP ServerInternal reference: DOV-6601Vulnerability type: CWE-770 (Allocation of Resources Without Limits or Throttling)Vulnerable version: 2.2, 2.3Vulnerable component: lib-mailReport confidence: ConfirmedSolution status: Fixed in 2.3.21.1Researcher credits: Vendor internal discoveryVendor notification: 2024-01-31CVE reference: CVE-2024-23185CVSS: 7.5 (CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:H) Vulnerability Details:Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-58981","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58981","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=58981"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58981\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=58981"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=58981"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=58981"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}