PT-2019-1904 · Dovecot+5 · Dovecot+5
Published
2019-02-05
·
Updated
2025-01-30
·
CVE-2019-7524
CVSS v3.1
8.8
High
| Vector | AC:L/AV:L/A:H/C:H/I:H/PR:L/S:C/UI:N |
Name of the Vulnerable Software and Affected Versions
Dovecot versions prior to 2.2.36.3
Dovecot versions 2.3.x prior to 2.3.5.1
Description
The issue is related to a lack of buffer size checks when reading FTS or POP3-UIDL headers from a Dovecot pointer. This can be exploited by a local attacker to cause a buffer overflow in the indexer-worker process, potentially allowing privilege escalation to root. The vulnerability is due to missing checks in the fts and pop3-uidl components.
Recommendations
For Dovecot versions prior to 2.2.36.3, update to version 2.2.36.3 or later.
For Dovecot versions 2.3.x prior to 2.3.5.1, update to version 2.3.5.1 or later.
As a temporary workaround, consider disabling the
indexer-worker process until a patch is available.
Restrict access to the fts and pop3-uidl components to minimize the risk of exploitation.Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Dovecot
Red Hat
Suse
Ubuntu