Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-15130: Dovecot mail server can crash from crafted TLS requests

CVE-2017-15130 · published 8 years ago

Summary

The Dovecot mail server (versions before 2.2.34) can be forced to use a lot of memory when it receives specially crafted TLS connection requests, causing it to stop and restart. This can interrupt email service. Update Dovecot to the latest version or apply the vendor’s patch to stop the issue.

What to do

Update dovecot dovecot to version 2.2.34 or later.

Affected software

Vendor	Product	Affected versions
dovecot	dovecot	< 2.2.34 `cpe:2.3:a:dovecot:dovecot::::::::`
debian	debian_linux	8.0 9.0 `cpe:2.3:o:debian:debian_linux:8.0:::::::*`
canonical	ubuntu_linux	14.04 16.04 17.10 `cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::`

Original advisory text

A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and ...

References

http://seclists.org/oss-sec/2018/q1/205 Mailing List Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1532356 Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html
https://usn.ubuntu.com/3587-1/ Third Party Advisory
https://usn.ubuntu.com/3587-2/
https://www.debian.org/security/2018/dsa-4130 Third Party Advisory
https://www.dovecot.org/list/dovecot-news/2018-February/000370.html Release Notes Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.9 Medium

Exploitation

3% chance of attack within 30 days

Type

CWE-400Uncontrolled Resource Consumption

Timeline

Published2 Mar 2018

Updated30 Oct 2026

First seen29 Sep 2026

Sources

CVE-2017-15130 · NVD

Track software like this

Free during beta