Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 20 May 2014 12:48:16 -0700
From: Seth Arnold <>
To: Yves-Alexis Perez <>
Subject: Re: CVE request: dovecot denial of service

On Tue, May 20, 2014 at 09:32:54PM +0200, Yves-Alexis Perez wrote:
> Hi,
> we were made aware of a recently fixed DoS vulnerability in Dovecot,
> which doesn't seem to have a CVE id assigned:
> states:
> * Fixed a DoS attack against imap/pop3-login processes. If SSL/TLS
>   handshake was started but wasn't finished, the login process
>   attempted to eventually forcibly disconnect the client, but failed
>   to do it correctly. This could have left the connections hanging
>   arond for a long time. (Affected Dovecot v1.1+)
> Could a CVE be assigned for this vulnerability?

CVE-2014-3430 was assigned for this issue:


Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.