CVE-2019-11500
First published: Wed Aug 14 2019(Updated: )
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/dovecot | <2.3.7.2 | 2.3.7.2 |
| redhat/dovecot | <2.2.36.4 | 2.2.36.4 |
| Dovecot Dovecot | <2.2.36.4 | |
| Dovecot Dovecot | >=2.3.0<2.3.7.2 | |
| Dovecot Pigeonhole | <0.5.7.2 | |
| Debian Debian Linux | =8.0 | |
| Fedoraproject Fedora | =30 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00026.html
- http://www.openwall.com/lists/oss-security/2019/08/28/3
- https://access.redhat.com/errata/RHSA-2019:2822
- https://access.redhat.com/errata/RHSA-2019:2836
- https://access.redhat.com/errata/RHSA-2019:2885
- https://dovecot.org/pipermail/dovecot-news/2019-August/000417.html
- https://lists.debian.org/debian-lts-announce/2019/08/msg00035.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3GYTZLLDNIFWT7D7JSB25ERJNMOR4CQ3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KVHY3MU2OK2EWZJFGNDSAOMD42L7DFPX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YSJVVVRAE3SITC2ZLGCPMFDN3WVYZBWF/
- https://security.gentoo.org/glsa/201908-29
- https://www.dovecot.org/security.html
- https://dovecot.org/pipermail/dovecot-news/2019-August/000418.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1746666
- https://www.openwall.com/lists/oss-security/2019/08/28/3
- https://github.com/dovecot/core/commit/85fcb895ca7f0bcb8ee72047fe0e1e78532ff90b
- https://github.com/dovecot/core/commit/f904cbdfec25582bc5e2a7435bf82ff769f2526a
- https://github.com/dovecot/pigeonhole/commit/7ce9990a5e6ba59e89b7fe1c07f574279aed922c
- https://github.com/dovecot/pigeonhole/commit/4a299840cdb51f61f8d1ebc0210b19c40dfbc1cc
- https://access.redhat.com/security/cve/CVE-2019-11500
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-11500
- https://dovecot.org/releases/2.2/dovecot-2.2.36.4.tar.gz
- https://doc.dovecot.org/admin_manual/system_users_used_by_dovecot
- https://wiki2.dovecot.org/LoginProcess
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741141#c18
- https://access.redhat.com/security/cve/cve-2019-11500
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741141#c20
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1741141#c24
- https://bugzilla.redhat.com/show_bug.cgi?id=1741141
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GYTZLLDNIFWT7D7JSB25ERJNMOR4CQ3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVHY3MU2OK2EWZJFGNDSAOMD42L7DFPX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSJVVVRAE3SITC2ZLGCPMFDN3WVYZBWF/
Frequently Asked Questions
What is CVE-2019-11500?
CVE-2019-11500 is a vulnerability in Dovecot and Pigeonhole that can lead to out-of-bounds writes and remote code execution.
What is the severity of CVE-2019-11500?
CVE-2019-11500 has a severity rating of 9.8 (Critical).
How does CVE-2019-11500 affect Dovecot and Pigeonhole?
CVE-2019-11500 affects Dovecot versions before 2.2.36.4 and 2.3.x before 2.3.7.2, and Pigeonhole versions before 0.5.7.2.
How can CVE-2019-11500 be fixed?
To fix CVE-2019-11500, it is recommended to update Dovecot to version 2.2.36.4 or 2.3.x version 2.3.7.2, and Pigeonhole to version 0.5.7.2.
Is there any additional information available about CVE-2019-11500?
Yes, you can find more information about CVE-2019-11500 at the following references: [Reference 1](http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00024.html), [Reference 2](http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00026.html), [Reference 3](http://www.openwall.com/lists/oss-security/2019/08/28/3)
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-11500
- agent/software-canonical-lookup
- agent/severity
- agent/author
- agent/weakness
- agent/remedy
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/dovecot
- canonical/dovecot dovecot
- version/dovecot dovecot/2.3.0
- canonical/dovecot pigeonhole
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/30