CVE-2017-2669

LOW

Dovecot < 2.2.29 - Denial of Service via Crafted %variable Expansion in dict Authentication

Title source: llm
STIX 2.1

Description

Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.

References (6)

Core 6
Core References
Vendor Advisory mailing-list x_refsource_mlist
https://dovecot.org/pipermail/dovecot-news/2017-April/000341.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2017/04/11/1
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2669
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2017/dsa-3828
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/97536

Scores

CVSS v3 3.7
EPSS 0.0464
EPSS Percentile 90.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Details

CWE
CWE-20
Status published
Products (2)
debian/debian_linux 8.0
dovecot/dovecot 2.2.26 - 2.2.28
Published Jun 21, 2018
Tracked Since Feb 18, 2026