Description
The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) via vectors related to handshake failures.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | 1:2.2.13-12 | — |
| Debian 13 | dovecot | 1:2.2.13-12 | — |
| Debian 12 | dovecot | 1:2.2.13-12 | — |
References
- [oss-security] 20150428 Re: Re: CVE request: Dovecot remote DoS on TLS connections mailing-list
- [dovecot] 20150424 [patch] TLS Handshake failures can crash imap-login mailing-list
- [dovecot-news] 20150513 [Dovecot-news] v2.2.17 released mailing-list
- FEDORA-2015-7159 vendor-advisory
- FEDORA-2015-7156 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1216057
- FEDORA-2015-7089 vendor-advisory
- [oss-security] 20150427 Re: CVE request: Dovecot remote DoS on TLS connections mailing-list
- 74335 vdb-entry