[Dovecot-news] CVE-2019-11499: Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent
aki.tuomi at open-xchange.com
Tue Apr 30 16:26:54 EEST 2019
Open-Xchange Security Advisory 2019-04-30
Vendor: OX Software GmbH
Internal reference: DOV-3223 (Bug ID)
Vulnerability type: CWE-617
Vulnerable version: 2.3.0 - 18.104.22.168
Vulnerable component: submission-login
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 2.3.6
Vendor notification: 2019-03-11
Solution date: 2019-04-23
Public disclosure: 2019-04-30
CVE reference: CVE-2019-11499
CVSS: 7.5 (CVSS3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent. This can lead to denial-of-service attack by persistent attacker(s).
Authentication crash can be avoided if authentication is done without TLS.
Operators should upgrade to a fixed version.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 475 bytes
Desc: not available
More information about the Dovecot-news