[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 13 Dec 2019 16:17:51 +0200 (EET)
From: Aki Tuomi <aki.tuomi@...n-xchange.com>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: CVE-2019-19722: Critical vulnerability in Dovecot
> On 13/12/2019 12:44 Aki Tuomi <aki.tuomi@...ecot.fi> wrote:
>
>
> Open-Xchange Security Advisory 2019-12-13
>
> Product: Dovecot IMAP/POP3 Server
> Vendor: OX Software GmbH
>
> Internal reference: DOV-3719
> Vulnerability type: NULL Pointer Dereference (CWE-476)
> Vulnerable version: 2.3.9
> Vulnerable component: push notification driver
> Report confidence: Confirmed
> Solution status: Fixed by Vendor
> Fixed version: 2.3.9.1
> Researcher credits: Frederik Schwan, Michael Stilkerich
> Vendor notification: 2019-12-10
> Solution date: 2019-12-12
> Public disclosure: 2019-12-13
> CVE reference: CVE-2019-19722
> CVSS: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F/RL:O/RC:C)
>
> Vulnerability Details:
> Mail with group address as sender will cause a signal 11 crash in push
> notification drivers. Group address as recipient can cause crash in some
> drivers.
>
> Risk:
> Repeated delivery attempts are made for the problematic mail, causing
> queueing in MTA.
>
> Steps to reproduce:
> 1. Configure dovecot with push notifications enabled, such as OX push
> notification driver. This can also be observed with 3rd party plugin XAPS.
> 2. Send mail a group address as sender
>
> Solution:
> Operators should update to the latest Patch Release.
Due to bug in the fix, we had to release 2.3.9.2 which completes the fix for this CVE.
---
Aki Tuomi
Open-Xchange oy
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
