Dovecot IMAP Server Crash Vulnerability - CVE-2019-11494
Summary
ALPINE-CVE-2019-11494: In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects prematurely during the AUTH command. Affects dovecot versions < 2.3.6-r0. Fixed in 2.3.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dovecot is an open-source IMAP and POP3 email server for Unix-like operating systems, designed to provide secure and efficient email handling. It is widely used for its performance and flexibility, supporting various authentication mechanisms and mail storage formats. However, versions 2.3.3 through 2.3.5.2 of Dovecot contain a vulnerability that can lead to a crash of the submission-login service when a client disconnects prematurely during the AUTH command.
Vulnerability Detail
The vulnerability, identified as CVE-2019-11494, arises from improper handling of client disconnections during the authentication process. When a client disconnects unexpectedly while the server is processing the AUTH command, it causes the submission-login service to crash. This can lead to denial of service, impacting the availability of the email service for users. The vulnerability affects multiple versions of Dovecot, making it critical for administrators to address it promptly.
How To Fix
Minimum fixed version
2.3.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade dovecotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing connection timeout settings to limit the impact of premature disconnections. This can help mitigate the risk of service crashes until the package is updated.
Conclusion
CVE-2019-11494 is a significant vulnerability affecting Dovecot versions 2.3.3 to 2.3.5.2, leading to potential service crashes. It is crucial for users to update to the patched version to maintain the integrity and availability of their email services. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for dovecot →
FAQ
CVE-2019-11494 is a vulnerability in Dovecot that causes the submission-login service to crash when a client disconnects during the AUTH command.
The affected versions are Dovecot 2.3.3 through 2.3.5.2. It is important to update to version 2.3.6-r0 or later.
The vulnerability can lead to denial of service, making the email service unavailable to users.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2019-11494 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for dovecot.
