Date: Mon, 28 Jun 2021 10:02:07 +0300 (EEST) From: Aki Tuomi <aki.tuomi@...n-xchange.com> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: CVE-2020-28200: Dovecot Pigeonhole Sieve excessive resource usage Open-Xchange Security Advisory 2021-06-28 Affected product: Dovecot IMAP Server Vendor: OX Software GmbH Internal reference: DOV-4159 Vulnerability type: Uncontrolled Resource Consumption (CWE-400) Vulnerable version: ancient Vulnerable component: sieve Report confidence: Confirmed Solution status: Fix available Researcher credits: Innokentii Sennovskii from BI.ZONE (rumata) Vendor notification: 2020-09-23 CVE reference: CVE-2020-28200 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vulnerability Details: Sieve interpreter is not protected against abusive scripts that claim excessive resource usage. Fixed by limiting both the CPU system+user time per single script execution and cumulatively over several script runs within a configurable timeout period. Sufficiently large CPU time usage is summed in the Sieve script binary and execution is blocked when the sum exceeds the limit within that time. The block is lifted when the script is updated after the resource usage times out. Risk: Attacker can cause uncontrolled CPU resource consumption to cause partial or complete denial of service. Steps to reproduce: Use sufficiently CPU intensive regular expression. Solution: Install patched version of Dovecot Workaround: Disable sieve "regex" extension.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.