Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 7 May 2015 10:39:06 +0200
From: Hanno Böck <>
Subject: Re: CVE request: Dovecot remote DoS on TLS

On Thu, 7 May 2015 10:15:49 +0200
Sven Kieske <> wrote:

> Hash: SHA1
> On 26/04/15 20:31, Hanno Böck wrote:
> > The current Dovecot (2.2.16) imap/pop3 server has an issue that 
> > handshake failures will lead to a crash of the login process.
> Do you happen to know in which version this vulnerability got
> introduced?

But things are comlicated: There was some breakage in 2.2.13 regarding
TLS so some distros (I know this from Gentoo) backported some TLS
related patches to 2.2.13, therefore you could also see it there.

Also, you'll probably only see this with SSLv3 disabled. (at least
that's the only situation where this particular crash in openssl can be
triggered, but there may be other codepaths affected by that problem)

Hanno Böck


Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.