REDHAT-BUG-2452171: High severity Dovecot doveadm vulnerability
Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring out the credential will lead into full access to the affected component. Limit access to the doveadm http service port, install fixed version. No publicly available exploits are known.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the doveadm HTTP service port to trusted IPs or internal networks (for example via firewall rules, ACLs, or network segmentation) until a fixed version can be installed.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2452171?
The severity of REDHAT-BUG-2452171 is high, rated at 7.
How do I fix REDHAT-BUG-2452171?
To fix REDHAT-BUG-2452171, limit access to the doveadm http service port to reduce exposure.
What type of attack does REDHAT-BUG-2452171 make the system vulnerable to?
REDHAT-BUG-2452171 makes the system vulnerable to a timing oracle attack which can reveal credentials.
What component is affected by REDHAT-BUG-2452171?
The affected component by REDHAT-BUG-2452171 is the Dovecot doveadm service.
What could be the consequence of exploiting REDHAT-BUG-2452171?
Exploiting REDHAT-BUG-2452171 may lead to full access to the affected Dovecot component.