Date: Tue, 4 Dec 2012 15:48:21 -0700 From: Vincent Danen <vdanen@...hat.com> To: Moritz Muehlenhoff <jmm@...ian.org> Cc: oss-security@...ts.openwall.com, Kurt Seifried <kseifried@...hat.com> Subject: Re: CVE request: Dovecot DoS in 2.x (fixed in 2.1.11) * [2012-12-04 23:01:42 +0100] Moritz Muehlenhoff wrote: >On Tue, Dec 04, 2012 at 06:12:29PM +0100, Matthias Weckbecker wrote: >> Hi Kurt, Vincent, vendors, ... >> >> Quoting Kurt Seifried <kseifried@...hat.com>: >> >-----BEGIN PGP SIGNED MESSAGE----- >> >Hash: SHA1 >> > >> >On 12/03/2012 10:33 AM, Vincent Danen wrote: >> >>Could a CVE be assigned for the following please? >> >> >> >>Dovecot 2.1.11 was released and includes a fix for a crash >> >>condition when the IMAP server was issued a SEARCH command with >> >>multiple KEYWORD parameters. An authenticated remote user could >> >>use this flaw to crash Dovecot. >> >> >> [...] >> >> >> >> >> >>Thanks. >> > >> >Please use CVE-2012-5620 for this issue. >> > >> >> We were discussing this issue too at  and think that it does only >> affect the current connection, no subsequent (i.e. new) connections >> are affected. >> >> What's your opinion wrt this? >> >>  https://bugzilla.novell.com/show_bug.cgi?id=792642 > >Upstream (Timo Sirainen) disputed the issue in the Debian BTS: >http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695138#15 Ahhh... yes, Timo is correct. If you're only DoS'ing your own connection, I wouldn't consider this a flaw. I (mistakenly) thought this took down the entire dovecot server. My apologies. Can we have this CVE rejected or disputed? As Timo says, it's a pointless CVE. Thanks, and sorry about that. -- Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.