[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 4 Dec 2012 23:01:42 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: oss-security@...ts.openwall.com
Cc: Kurt Seifried <kseifried@...hat.com>, Vincent Danen <vdanen@...hat.com>
Subject: Re: CVE request: Dovecot DoS in 2.x (fixed in 2.1.11)
On Tue, Dec 04, 2012 at 06:12:29PM +0100, Matthias Weckbecker wrote:
> Hi Kurt, Vincent, vendors, ...
>
> Quoting Kurt Seifried <kseifried@...hat.com>:
> >-----BEGIN PGP SIGNED MESSAGE-----
> >Hash: SHA1
> >
> >On 12/03/2012 10:33 AM, Vincent Danen wrote:
> >>Could a CVE be assigned for the following please?
> >>
> >>Dovecot 2.1.11 was released and includes a fix for a crash
> >>condition when the IMAP server was issued a SEARCH command with
> >>multiple KEYWORD parameters. An authenticated remote user could
> >>use this flaw to crash Dovecot.
> >>
> [...]
> >>
> >>
> >>Thanks.
> >
> >Please use CVE-2012-5620 for this issue.
> >
>
> We were discussing this issue too at [1] and think that it does only
> affect the current connection, no subsequent (i.e. new) connections
> are affected.
>
> What's your opinion wrt this?
>
> [1] https://bugzilla.novell.com/show_bug.cgi?id=792642
Upstream (Timo Sirainen) disputed the issue in the Debian BTS:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695138#15
Cheers,
Moritz
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
