CVE-2024-23184: Dovecot CVE-2024-23184: Having a large number of addss headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive
Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors sending emails to a victim, this is a security issue. An external attacker can send specially crafted messages that consume target system resources and cause outage. One can implement restrictions on address headers on MTA component preceding Dovecot. No publicly available exploits are known.
Other sources
Vulnerability Details: Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors sending emails to a victim, this is a security issue.
The main problem is that each header line's address is added to the end of a linked list. This is done by walking the whole linked list, which becomes more inefficient the more addresses there are.
Workaround: One can implement restrictions on address headers on MTA component preceding Dovecot.
Fix: Install non-vulnerable version of Dovecot. Patch can be found at https://github.com/dovecot/core/compare/8e4c42d%5E...1481c04.patch
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23184?
CVE-2024-23184 is considered to have a high severity due to excessive CPU usage when processing a high number of email header lines.
How do I fix CVE-2024-23184?
To fix CVE-2024-23184, update the Dovecot package to one of the patched versions: 1:2.3.13+dfsg1-2+deb11u2, 1:2.3.19.1+dfsg1-2.1+deb12u1, or 1:2.3.21.1+dfsg1-1.
What systems are affected by CVE-2024-23184?
CVE-2024-23184 affects specific versions of the Dovecot email server software running on Debian.
What mitigation steps can be taken for CVE-2024-23184?
Mitigation can include limiting the number of headers in emails processed by Dovecot to reduce CPU load.
Is CVE-2024-23184 exploitable remotely?
Yes, CVE-2024-23184 can be triggered by external sources through crafted emails with excessive header lines.