PT-2024-5814 · Dovecot+10 · Dovecot Imap Server+10
Published
2024-08-15
·
Updated
2025-01-30
·
CVE-2024-23184
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Dovecot IMAP Server versions 2.2 through 2.3.20
Description
The issue is related to the excessive CPU usage caused by a large number of address headers in emails, which can be exploited by external actors to consume system resources and cause an outage. With 100k header lines, CPU usage can reach 12 seconds, and in production environments, 500k header lines have been observed to take 18 minutes to parse. This can be triggered by sending specially crafted messages to a victim. Implementing restrictions on address headers on the MTA component preceding Dovecot can help mitigate the issue.
Recommendations
For Dovecot IMAP Server versions 2.2 through 2.3.20, upgrade Dovecot immediately to a version that is not affected by this issue.
As a temporary workaround, consider implementing restrictions on address headers on the MTA component preceding Dovecot to minimize the risk of exploitation.
Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Dovecot Imap Server
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu