CVE-2017-14461: Infoleak
A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dovecotto a version that resolves this vulnerability.Fixed in 1:2.3.19.1+dfsg1-2.1+deb12u6Fixed in 1:2.3.19.1+dfsg1-2.1+deb12u7Fixed in 1:2.4.1+dfsg1-6+deb13u6Fixed in 1:2.4.1+dfsg1-6+deb13u7Fixed in 1:2.4.5+dfsg1-4
Event History
Frequently Asked Questions
What is CVE-2017-14461?
CVE-2017-14461 is a vulnerability that allows a specially crafted email to trigger an out of bounds read in Dovecot, potentially resulting in sensitive information disclosure and denial of service.
What is the severity of CVE-2017-14461?
The severity of CVE-2017-14461 is high, with a severity value of 7.1.
How does CVE-2017-14461 affect Dovecot?
CVE-2017-14461 affects Dovecot versions 2.2.33.2 and earlier, as well as some Ubuntu and Debian Linux distributions.
How can an attacker exploit CVE-2017-14461?
An attacker can exploit CVE-2017-14461 by sending a specially crafted email message to the server running Dovecot.
What is the remedy for CVE-2017-14461?
To remedy CVE-2017-14461, it is recommended to update Dovecot to version 2.2.34 or 2.3.0.1, or apply the appropriate security patches provided by the Ubuntu and Debian distributions.