PT-2021-18015 · Kopano+1 · Kopano Groupware Core+1

Jan Engelhardt · Published 2021-03-31 · Updated 2022-07-12 · CVE-2021-28994

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Kopano Groupware Core versions 8.7.16 and earlier, 9.x through 9.1.0, 10.x through 10.0.7, 11.x through 11.0.1 Zarafa versions 6.30.x through 7.2.x

Description: The issue allows memory exhaustion via long HTTP headers.

Recommendations: For Kopano Groupware Core versions 8.7.16 and earlier, update to a version later than 8.7.16. For Kopano Groupware Core versions 9.x through 9.1.0, update to a version later than 9.1.0. For Kopano Groupware Core versions 10.x through 10.0.7, update to a version later than 10.0.7. For Kopano Groupware Core versions 11.x through 11.0.1, update to a version later than 11.0.1. For Zarafa versions 6.30.x through 7.2.x, update to a version later than 7.2.x.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2021-28994

Affected Products

Kopano Groupware Core

Zarafa

References · 9

• 🔥 https://openwall.com/lists/oss-security/2021/03/19/6 · Exploit
• https://osv.dev/vulnerability/CVE-2021-28994 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-28994 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-28994 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-28994 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-28994 · Security Note
• http://openwall.com/lists/oss-security/2021/04/25/1 · Note
• http://openwall.com/lists/oss-security/2021/04/01/1 · Note
• https://t.me/cvenotify/13676 · Telegram Post