Denial of Service Vulnerability in Dovecot: CVE-2017-15130
Summary
ALPINE-CVE-2017-15130: A denial of service flaw was found in dovecot before 2.2.34. Affects dovecot versions < 2.3.1-r0. Fixed in 2.3.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dovecot is an open-source IMAP and POP3 email server for Unix-like operating systems, designed to provide secure and efficient email retrieval. It is widely used due to its performance, flexibility, and ease of configuration. However, prior to version 2.2.34, Dovecot was susceptible to a denial of service vulnerability that could be exploited through TLS SNI configuration lookups, leading to excessive memory usage.
Vulnerability Detail
The vulnerability, identified as CVE-2017-15130, arises from improper handling of Server Name Indication (SNI) during TLS connections. An attacker can generate random SNI server names, which triggers excessive memory consumption in the Dovecot process. This can lead to a denial of service, causing the server to restart and disrupt email services. The vulnerability affects multiple versions of Dovecot across various Alpine Linux releases.
How To Fix
Minimum fixed version
2.3.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade dovecotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the number of SNI lookups or implement firewall rules to restrict access to the Dovecot service from untrusted sources. However, upgrading to the patched version is the recommended solution.
Conclusion
CVE-2017-15130 represents a significant denial of service vulnerability in Dovecot, affecting various versions across multiple Alpine Linux releases. It is crucial to update to the patched version to ensure the security and stability of your email services. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for dovecot →
FAQ
CVE-2017-15130 is a denial of service vulnerability in Dovecot that can be exploited through TLS SNI configuration lookups, leading to excessive memory usage.
Versions of Dovecot prior to 2.2.34 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2017-15130 is 5.9, indicating a moderate severity level.
If an immediate upgrade is not possible, consider implementing firewall rules to restrict access or limiting SNI lookups as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for dovecot.
