Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 14 Aug 2013 18:40:38 +0300
From: Timo Sirainen <>
To: Raphael Geissert <>
Subject: Re: Possible CVE request: dovecot crash when disconnecting during pop3 LIST

On 14.8.2013, at 18.30, Raphael Geissert <> wrote:

> Dovecot's 2.2.5 release notes mention a fix for a client-triggered
> assert when disconnecting during a pop3 LIST[1]. Without more details,
> I can't tell if a CVE id should be assigned. Timo, could you please
> shed some more light, or provide a pointer to more details?

It doesn't deserve a CVE, there have been a lot of similar bugs in Dovecot and I don't think any of them have gotten a CVE. All post-login crashes affect only the one IMAP/POP3 connection that caused the crash itself, nobody else. (Unless Dovecot was configured in a non-recommended way to handle multiple clients per process, but just about nobody does that since it has other problems as well.) In this specific bug the POP3 client had already disconnected so the user isn't really DoSing himself either. So the only problem it caused was that Dovecot logged an assert error and maybe wrote a core dump.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.