On 2. Sep 2024, at 15.44, Guilhem Moulin via dovecot <dovecot@dovecot.org> wrote:
Hi Aki,
we are releasing a CVE patch release 2.3.21.1.
Your message to the oss-security list [0] says both 2.2 and 2.3 versions are vulnerable to CVE-2024-23184. Using the following test message as reproducer
From: foo@example.net To: bar1@example.net , bar2@example.net […] , bar$n@example.net Bcc: baz1@example.net […] Bcc: baz$n@example.net Date: $(LC_TIME=C.UTF-8 date -R) Subject: boom Message-Id: $(cat /proc/sys/kernel/random/uuid)@example.net
boom
I could reproduce the issue back to 2.3.10 but not with earlier versions. I used
doveadm fetch imap.envelope allto measure the (non-cached) IMAP ENVELOPE command.For n=100k, it takes ~20s with 2.3.19 vs. ~0.5s with early 2.3.x and 2.2.x. For n=500k, I measured ~2s with early 2.3.x and 2.2.x, so for these versions it doesn't look like parsing is O(n²) in the number of addresses.
I didn't try to bisect to pinpoint the exact commit, but AFAICT the main problem you described
| each header line's address is added to the end of a linked list. This | is done by walking the whole linked list, which becomes more inefficient | the more addresses there are.
was introduced in 2.3.10 by https://github.com/dovecot/core/commit/469fcd3bdd7df40bb8f4d131121f3bfbceade... .
Is my reproducer/analysis incorrect, or are versions before 2.3.10 immune to CVE-2024-23184? (AFAICT they are affected by CVE-2024-23185; only talking about -23184 here.)
Yes, looks like this is all correct. I guess we didn't really verify the oldest version this affects.