Moderate: dovecot security update
Summary
ALSA-2024:6529: Moderate: dovecot security update. Affects dovecot versions < 1:2.3.16-11.el9_4.1. Fixed in 1:2.3.16-11.el9_4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.
Vulnerability Detail
A vulnerability has been discovered in dovecot that could lead to denial of service and resource exhaustion. The vulnerability (CVE-2024-23184) can be triggered by using a large number of address headers, while the second vulnerability (CVE-2024-23185) occurs when parsing messages with very large headers. These vulnerabilities can be exploited by an attacker to disrupt the service and potentially exhaust system resources.
How To Fix
Minimum fixed version
1:2.3.16-11.el9_4.1
This is the first release that contains the fix.
sudo dnf update dovecotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible.
Conclusion
Dovecot, an IMAP server for Linux and UNIX-like systems, is affected by two vulnerabilities that can lead to denial of service and resource exhaustion. It is crucial to update the dovecot package to version 2.3.16-11.el9_4.1 or later to mitigate these vulnerabilities.
See every vulnerability recorded for dovecot →
FAQ
Dovecot is an IMAP server for Linux and UNIX-like systems, designed with security in mind. It provides support for email in maildir or mbox format and includes SQL drivers and authentication plug-ins.
These vulnerabilities can lead to denial of service and resource exhaustion. An attacker can exploit these vulnerabilities to disrupt the service and potentially exhaust system resources.
To fix the vulnerabilities, update the dovecot package to version 2.3.16-11.el9_4.1 or later.
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible.
You can find more information about these vulnerabilities on the CVE pages: CVE-2024-23184 and CVE-2024-23185.
Related vulnerabilities
Recent vulnerabilities recorded for dovecot.
