Threats Tagged 'cve-2024-23184'

Two vulnerabilities in Dovecot, an IMAP and POP3 server, can lead to denial of service or resource exhaustion. CVE-2024-23184 involves triggering a denial of service by using a large number of address headers. CVE-2024-23185 involves resource exhaustion caused by very large headers during message parsing. These issues affect Red Hat Enterprise Linux 8 and related builds. A security update addressing these vulnerabilities is available from Red Hat.

Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors sending emails to a victim, this is a security issue. An external attacker can send specially crafted messages that consume target system resources and cause outage. One can implement restrictions on address headers on MTA component preceding Dovecot. No publicly available exploits are known.

MediumVulnerabilityGermanyUnited KingdomFrance+4#cve#cve-2024-23184

Two vulnerabilities in Dovecot, an IMAP and POP3 server, can lead to denial of service or resource exhaustion. CVE-2024-23184 involves triggering denial of service by using a large number of address headers. CVE-2024-23185 involves resource exhaustion caused by very large headers during message parsing. These issues affect Red Hat Enterprise Linux 9 and related variants. A security update addressing these vulnerabilities is available from Red Hat.

Two vulnerabilities in Dovecot, an IMAP and POP3 server, can lead to denial of service or resource exhaustion. CVE-2024-23184 involves triggering a denial of service by using a large number of address headers. CVE-2024-23185 involves resource exhaustion caused by very large headers during message parsing. Red Hat has released security updates addressing these issues in Red Hat Enterprise Linux 9.2 Extended Update Support and related variants.