Dovecot JSON Encoder Vulnerability: Denial of Service Risk
Summary
ALPINE-CVE-2019-10691: The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username. Affects dovecot versions < 2.3.6-r0. Fixed in 2.3.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dovecot is an open-source IMAP and POP3 email server for Unix-like operating systems, designed to provide a secure and efficient email service. It is widely used for its performance, scalability, and support for various authentication methods. However, a vulnerability in its JSON encoder has been identified, which could lead to service disruptions.
Vulnerability Detail
The vulnerability arises from the JSON encoder in Dovecot versions prior to 2.3.5.2, which allows attackers to crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username. This can lead to a denial of service, affecting the availability of the email service for legitimate users. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.3.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade dovecotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to reject invalid UTF-8 sequences in usernames before they reach the Dovecot authentication service. This can help mitigate the risk until the package is updated.
Conclusion
The Dovecot JSON encoder vulnerability poses a significant risk of denial of service, impacting the availability of email services. It is crucial to update to the patched version to mitigate this risk. For those unable to update immediately, implementing input validation can serve as a temporary measure.
See every vulnerability recorded for dovecot →
FAQ
The vulnerability can lead to a denial of service, causing the Dovecot authentication service to crash and making email services unavailable.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Yes, the patch is available in Dovecot version 2.3.6-r0 and later. It is recommended to update to this version or newer.
If an immediate update is not possible, implement input validation to reject invalid UTF-8 sequences in usernames as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for dovecot.
