CVSS: 7.7EPSS: 0%CPEs: 8EXPL: 1CVE-2019-3814 – dovecot: Improper certificate validation
https://notcve.org/view.php?id=CVE-2019-3814
05 Feb 2019 — It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users. Se ha descubierto que Dovecot, en versiones anteriores a la 2.2.36.1 y 2.3.4.1, gestiona de manera incorrecta los certificados del cliente. Un atacante remoto en posesión de un certificado válido con un campo "username" vacío podría emplear este problema para s... • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00067.html • CWE-295: Improper Certificate Validation •
CVSS: 5.9EPSS: 1%CPEs: 6EXPL: 0CVE-2017-15130 – Debian Security Advisory 4130-1
https://notcve.org/view.php?id=CVE-2017-15130
02 Mar 2018 — A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart. Se ha descubierto un error de denegación de servicio (DoS) en dovecot en versiones anteriores a la 2.2.34. Un atacante que pueda generar nombres aleatorios del servidor SNI podría explotar las búsquedas de configuración TLS SNI, lo que conduce a un uso excesivo de memoria y al reinicio del ... • http://seclists.org/oss-sec/2018/q1/205 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.1EPSS: 1%CPEs: 6EXPL: 0CVE-2017-14461 – Debian Security Advisory 4130-1
https://notcve.org/view.php?id=CVE-2017-14461
02 Mar 2018 — A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server. Un email especialmente manipulado enviado mediante SMTP y pasado a Dovecot, de MTA, puede desencadenar una lectura fuera de límites que resulta en la posible revelación de información sensible y una denegac... • http://www.securityfocus.com/bid/103201 • CWE-125: Out-of-bounds Read CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 2%CPEs: 9EXPL: 0CVE-2017-15132 – Ubuntu Security Notice USN-3556-1
https://notcve.org/view.php?id=CVE-2017-15132
25 Jan 2018 — A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion. Se ha detectado un fallo en dovecot desde la versión 2.0 hasta la 2.2.33 y 2.3.0. El aborto de una autenticación SASL resulta en una fuga de memoria en el cliente de autenticación de dovecot utili... • https://bugzilla.redhat.com/show_bug.cgi?id=1532768 • CWE-400: Uncontrolled Resource Consumption CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 7.5EPSS: 7%CPEs: 2EXPL: 0CVE-2017-2669 – Ubuntu Security Notice USN-3258-2
https://notcve.org/view.php?id=CVE-2017-2669
11 Apr 2017 — Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang. Dovecot en versiones anteriores a la 2.2.29 es vulnerable a una denegación de servicio (D... • http://www.openwall.com/lists/oss-security/2017/04/11/1 • CWE-20: Improper Input Validation •
CVSS: 5.9EPSS: 16%CPEs: 1EXPL: 0CVE-2016-8652
https://notcve.org/view.php?id=CVE-2016-8652
16 Feb 2017 — The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) by aborting authentication without setting a username. El componente de autenticación en Dovecot en versiones anteriores a 2.2.27, cuando la política de autenticación es configurada, permite a atacantes remotos provocar una denegación de servicio (caída) abortando la autenticación sin establecer un nombre de usuario. • http://dovecot.org/pipermail/dovecot-news/2016-December/000333.html • CWE-20: Improper Input Validation •