REDHAT-BUG-2452175: High severity Dovecot Dovecot ManageSieve vulnerability
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the managesieve protocol to trusted hosts/networks using firewall rules, ACLs, or a VPN. Limit exposure to untrusted networks until a fixed version is installed.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2452175?
The severity of REDHAT-BUG-2452175 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2452175?
To fix REDHAT-BUG-2452175, you should either protect access to the managesieve protocol or install the fixed version of the software.
What type of attack does REDHAT-BUG-2452175 describe?
REDHAT-BUG-2452175 describes a denial-of-service attack that can crash the managesieve-login process.
What software is affected by REDHAT-BUG-2452175?
The affected software in REDHAT-BUG-2452175 is Dovecot ManageSieve.
What impact does REDHAT-BUG-2452175 have on server availability?
REDHAT-BUG-2452175 can make the managesieve-login service unavailable by exhausting system memory.