The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username.

The remote host is affected by the vulnerability described in GLSA-201908-29 (Dovecot: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Dovecot. Please review       the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker could send a specially crafted mail       or use crafted IMAP commands possibly resulting in the execution of       arbitrary code with the privileges of the process or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

According to the versions of the dovecot packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a     local attacker can cause a buffer overflow in the     indexer-worker process, which can be used to elevate to     root. This occurs because of missing checks in the fts     and pop3-uidl components.(CVE-2019-7524)

  - The JSON encoder in Dovecot before 2.3.5.2 allows     attackers to repeatedly crash the authentication     service by attempting to authenticate with an invalid     UTF-8 sequence as the username.(CVE-2019-10691)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dovecot23 fixes the following issues :

Security issue fixed :

  - CVE-2019-10691: Fixed a denial of service via reachable     assertion when processing invalid UTF-8 characters     (bsc#1132501).

This update was imported from the SUSE:SLE-15:Update update project.

It was discovered that the Dovecot JSON encoder incorrectly handled certain invalid UTF-8 characters. A remote attacker could possibly use this issue to cause Dovecot to repeatedly crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dovecot23 fixes the following issues :

Security issue fixed :

CVE-2019-10691: Fixed a denial of service via reachable assertion when processing invalid UTF-8 characters (bsc#1132501).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Aki Tuomi reports :

* CVE-2019-10691: Trying to login with 8bit username containing invalid UTF8 input causes auth process to crash if auth policy is enabled. This could be used rather easily to cause a DoS. Similar crash also happens during mail delivery when using invalid UTF8 in From or Subject header when OX push notification driver is used.

ID	Name	Product	Family	Severity
128444	GLSA-201908-29 : Dovecot: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
126271	EulerOS 2.0 SP8 : dovecot (EulerOS-SA-2019-1644)	Nessus	Huawei Local Security Checks	high
124581	openSUSE Security Update : dovecot23 (openSUSE-2019-1312)	Nessus	SuSE Local Security Checks	high
124273	Ubuntu 18.10 / 19.04 : Dovecot vulnerability (USN-3951-1)	Nessus	Ubuntu Local Security Checks	high
124270	SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2019:0997-1)	Nessus	SuSE Local Security Checks	high
124183	FreeBSD : dovecot -- json encoder crash (a64aa22f-61ec-11e9-85b9-a4badb296695)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2019-10691

high

Tenable Plugins

critical

high

high

high

high

high