Date: Tue, 4 Dec 2012 23:01:42 +0100 From: Moritz Muehlenhoff <jmm@...ian.org> To: oss-security@...ts.openwall.com Cc: Kurt Seifried <kseifried@...hat.com>, Vincent Danen <vdanen@...hat.com> Subject: Re: CVE request: Dovecot DoS in 2.x (fixed in 2.1.11) On Tue, Dec 04, 2012 at 06:12:29PM +0100, Matthias Weckbecker wrote: > Hi Kurt, Vincent, vendors, ... > > Quoting Kurt Seifried <kseifried@...hat.com>: > >-----BEGIN PGP SIGNED MESSAGE----- > >Hash: SHA1 > > > >On 12/03/2012 10:33 AM, Vincent Danen wrote: > >>Could a CVE be assigned for the following please? > >> > >>Dovecot 2.1.11 was released and includes a fix for a crash > >>condition when the IMAP server was issued a SEARCH command with > >>multiple KEYWORD parameters. An authenticated remote user could > >>use this flaw to crash Dovecot. > >> > [...] > >> > >> > >>Thanks. > > > >Please use CVE-2012-5620 for this issue. > > > > We were discussing this issue too at  and think that it does only > affect the current connection, no subsequent (i.e. new) connections > are affected. > > What's your opinion wrt this? > >  https://bugzilla.novell.com/show_bug.cgi?id=792642 Upstream (Timo Sirainen) disputed the issue in the Debian BTS: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695138#15 Cheers, Moritz
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.