[<prev] [next>] [day] [month] [year] [list]
Message-ID: <1174037964.13457.1624863727539@appsuite-dev-gw2.open-xchange.com>
Date: Mon, 28 Jun 2021 10:02:07 +0300 (EEST)
From: Aki Tuomi <aki.tuomi@...n-xchange.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE-2020-28200: Dovecot Pigeonhole Sieve excessive resource usage
Open-Xchange Security Advisory 2021-06-28
Affected product: Dovecot IMAP Server
Vendor: OX Software GmbH
Internal reference: DOV-4159
Vulnerability type: Uncontrolled Resource Consumption (CWE-400)
Vulnerable version: ancient
Vulnerable component: sieve
Report confidence: Confirmed
Solution status: Fix available
Researcher credits: Innokentii Sennovskii from BI.ZONE (rumata)
Vendor notification: 2020-09-23
CVE reference: CVE-2020-28200
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Vulnerability Details:
Sieve interpreter is not protected against abusive scripts that claim excessive resource usage.
Fixed by limiting both the CPU system+user time per single script execution and cumulatively over
several script runs within a configurable timeout period. Sufficiently large CPU time usage is
summed in the Sieve script binary and execution is blocked when the sum exceeds the limit within that time.
The block is lifted when the script is updated after the resource usage times out.
Risk:
Attacker can cause uncontrolled CPU resource consumption to cause partial or complete denial of service.
Steps to reproduce:
Use sufficiently CPU intensive regular expression.
Solution:
Install patched version of Dovecot
Workaround:
Disable sieve "regex" extension.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
