Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <1ddea9c3-3475-8f6a-95db-099c055076e6@dovecot.fi>
Date: Mon, 5 Dec 2016 09:00:13 +0200
From: Aki Tuomi <aki.tuomi@...ecot.fi>
To: oss-security@...ts.openwall.com
Subject: Re: Important vulnerability in Dovecot (CVE-2016-8652)



On 02.12.2016 09:02, Aki Tuomi wrote:
> Important vulnerability in Dovecot (CVE-2016-8652)
> CVSS score: 7.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H)
> Affected version(s): 2.2.25.1 up to 2.2.26.1
> Fixed in: 2.2.27.1rc1
>
> Short summary: Dovecot auth component can be crashed by remote user when
> auth-policy component is activated.
>
> If auth-policy component has been activated in Dovecot, then remote user
> can use SASL authentication to crash auth component.
>
> Workaround is to disable auth-policy component until fix is in place.
> This can be done by commenting out all auth_policy_* settings.
>
> Aki Tuomi
> Dovecot oy
>

The affected versions are from 2.2.25 to 2.2.26.1.

Aki Tuomi
Dovecot oy

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.