oss-sec mailing list archives
CVE-2020-28200: Dovecot Pigeonhole Sieve excessive resource usage
From: Aki Tuomi <aki.tuomi () open-xchange com>
Date: Mon, 28 Jun 2021 10:02:07 +0300 (EEST)
Open-Xchange Security Advisory 2021-06-28 Affected product: Dovecot IMAP Server Vendor: OX Software GmbH Internal reference: DOV-4159 Vulnerability type: Uncontrolled Resource Consumption (CWE-400) Vulnerable version: ancient Vulnerable component: sieve Report confidence: Confirmed Solution status: Fix available Researcher credits: Innokentii Sennovskii from BI.ZONE (rumata) Vendor notification: 2020-09-23 CVE reference: CVE-2020-28200 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vulnerability Details: Sieve interpreter is not protected against abusive scripts that claim excessive resource usage. Fixed by limiting both the CPU system+user time per single script execution and cumulatively over several script runs within a configurable timeout period. Sufficiently large CPU time usage is summed in the Sieve script binary and execution is blocked when the sum exceeds the limit within that time. The block is lifted when the script is updated after the resource usage times out. Risk: Attacker can cause uncontrolled CPU resource consumption to cause partial or complete denial of service. Steps to reproduce: Use sufficiently CPU intensive regular expression. Solution: Install patched version of Dovecot Workaround: Disable sieve "regex" extension.
Current thread:
- CVE-2020-28200: Dovecot Pigeonhole Sieve excessive resource usage Aki Tuomi (Jun 28)