oss-sec mailing list archives
Re: CVE request: dovecot denial of service
From: Yves-Alexis Perez <corsac () debian org>
Date: Tue, 20 May 2014 21:48:17 +0200
On mar., 2014-05-20 at 21:32 +0200, Yves-Alexis Perez wrote:
Hi, we were made aware of a recently fixed DoS vulnerability in Dovecot, which doesn't seem to have a CVE id assigned: http://dovecot.org/list/dovecot-news/2014-May/000273.html states: * Fixed a DoS attack against imap/pop3-login processes. If SSL/TLS handshake was started but wasn't finished, the login process attempted to eventually forcibly disconnect the client, but failed to do it correctly. This could have left the connections hanging arond for a long time. (Affected Dovecot v1.1+) Could a CVE be assigned for this vulnerability?
It looks like this is the CVE-2014-3430 assigned in <201405092055.s49KtC6i025402 () linus mitre org> not long ago. -- Yves-Alexis
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- CVE request: dovecot denial of service Yves-Alexis Perez (May 20)
- Re: CVE request: dovecot denial of service Seth Arnold (May 20)
- Re: CVE request: dovecot denial of service Marc Deslauriers (May 20)
- Re: CVE request: dovecot denial of service Yves-Alexis Perez (May 20)