PT-2019-2582 · Dovecot+3 · Dovecot+3
Published
2019-04-02
·
Updated
2025-01-30
·
CVE-2019-10691
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Dovecot versions prior to 2.3.5.2
Description
The issue is related to the JSON encoder in the authentication service, which can be exploited by attempting to authenticate with an invalid UTF-8 sequence as the
username. This can cause the authentication service to crash repeatedly, leading to a denial of service. The vulnerability can be exploited by a remote attacker.Recommendations
For versions prior to 2.3.5.2, update to version 2.3.5.2 or later to resolve the issue.
As a temporary workaround, consider restricting access to the authentication service to minimize the risk of exploitation.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Dovecot
Suse
Ubuntu