CVE-2017-2669: Input Validation
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through varexpand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2669?
CVE-2017-2669 is classified as a denial of service vulnerability affecting Dovecot versions before 2.2.29.
How do I fix CVE-2017-2669?
To mitigate CVE-2017-2669, upgrade Dovecot to version 2.2.29 or later.
Which versions of Dovecot are affected by CVE-2017-2669?
CVE-2017-2669 affects Dovecot versions prior to 2.2.29.
What is the impact of CVE-2017-2669?
The impact of CVE-2017-2669 could lead to a denial of service for systems using Dovecot for user authentication.
Is there a known exploit for CVE-2017-2669?
Yes, CVE-2017-2669 can be exploited by sending specially crafted usernames that trigger vulnerability in variable expansion.