Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up "full_value" buffer out of the smaller chunks. The full_value buffer has no size limit, so large headers can cause large memory usage. It doesn't matter whether it's a single long header line, or a single header split into multiple lines. This bug exists in all Dovecot versions. Incoming mails typically have some size limits set by MTA, so even largest possible header size may still fit into Dovecot's vsz_limit. So attackers probably can't DoS a victim user this way. A user could APPEND larger mails though, allowing them to DoS themselves (although maybe cause some memory issues for the backend in general). One can implement restrictions on headers on MTA component preceding Dovecot. No publicly available exploits are known.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-785 advisory.

    Dovecot reports: A DoS is possible with a large number of address headers or abnormally large email     headers. (CVE-2024-23184)

    Dovecot reports: A DoS is possible with a large number of address headers or abnormally large email     headers. (CVE-2024-23185)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:6973 advisory.

    * dovecot: using a large number of address headers may trigger a denial of service (CVE-2024-23184)
    * dovecot: very large headers can cause resource exhaustion when parsing message (CVE-2024-23185)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-6973 advisory.

    - fix CVE-2024-23185: very large headers can cause resource exhaustion when parsing message (RHEL-55219)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6973 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: using a large number of address headers may trigger a denial of service (CVE-2024-23184)

    * dovecot: very large headers can cause resource exhaustion when parsing message (CVE-2024-23185)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6529 advisory.

    * dovecot: using a large number of address headers may trigger a denial of service (CVE-2024-23184)

    * dovecot: very large headers can cause resource exhaustion when parsing message (CVE-2024-23185)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7013-1 advisory.

    It was discovered that Dovecot incorrectly handled a large number of address headers. A remote attacker     could possibly use this issue to cause Dovecot to consume resources, leading to a denial of service.
    (CVE-2024-23184)

    It was discovered that Dovecot incorrectly handled very large headers. A remote attacker could possibly     use this issue to cause Dovecot to consume resources, leading to a denial of service. (CVE-2024-23185)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:6529 advisory.

    * dovecot: using a large number of address headers may trigger a denial of service (CVE-2024-23184)
    * dovecot: very large headers can cause resource exhaustion when parsing message (CVE-2024-23185)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-6529 advisory.

    - fix CVE-2024-23184: using a large number of address headers may trigger a denial of service (RHEL-55211)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6529 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: using a large number of address headers may trigger a denial of service (CVE-2024-23184)

    * dovecot: very large headers can cause resource exhaustion when parsing message (CVE-2024-23185)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6465 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: using a large number of address headers may trigger a denial of service (CVE-2024-23184)

    * dovecot: very large headers can cause resource exhaustion when parsing message (CVE-2024-23185)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3118-1 advisory.

    - CVE-2024-23185: Fixed a denial of service with large headers (bsc#1229183)
    - CVE-2024-23184: Fixed a denial of service parsing messages containing many address headers (bsc#1229184)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3860 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3860-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     September 02, 2024                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : dovecot     Version        : 1:2.3.13+dfsg1-2+deb11u2     CVE ID         : CVE-2024-23184 CVE-2024-23185     Debian Bug     : 1078876 1078877

    Vulnerabilities were discovered in dovecot, an POP3/IMAP server, which     could lead to Denial of Service.

    CVE-2024-23184

        Having a large number of address headers (From, To, Cc, Bcc, etc.)         becomes excessively CPU intensive.

    CVE-2024-23185

        Very large headers can cause resource exhaustion when parsing         message.

    For Debian 11 bullseye, these problems have been fixed in version     1:2.3.13+dfsg1-2+deb11u2.

    We recommend that you upgrade your dovecot packages.

    For the detailed security status of dovecot please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/dovecot

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6982-1 advisory.

    It was discovered that Dovecot did not not properly have restrictions on ithe size of address headers. A     remote attacker could possibly use this issue to cause denial of service. (CVE-2024-23184, CVE-2024-23185)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-ba5bb9f63a advisory.

    - CVE-2024-23184: A large number of address headers in email resulted in excessive CPU usage.
    - CVE-2024-23185: Abnormally large email headers are now truncated or discarded, with a limit of 10MB on a     single header and 50MB for all the headers of all the parts of an email.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e23e8a3f1e advisory.

    - CVE-2024-23184: A large number of address headers in email resulted in excessive CPU usage.
    - CVE-2024-23185: Abnormally large email headers are now truncated or discarded, with a limit of 10MB on a     single header and 50MB for all the headers of all the parts of an email.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5752 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5752-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     August 21, 2024                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : dovecot     CVE ID         : CVE-2024-23184 CVE-2024-23185

    Two vulnerabilities have been discovered in the IMAP implementation of     the Dovecot mail server: Excessive numbers of address headers or very     large headers can result in high CPU usage, leading to denial of     service.

    For the stable distribution (bookworm), these problems have been fixed in     version 1:2.3.19.1+dfsg1-2.1+deb12u1.

    We recommend that you upgrade your dovecot packages.

    For the detailed security status of dovecot please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/dovecot

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6a6ad6cb-5c6c-11ef-b456-001e676bf734 advisory.

    Dovecot reports:
    A DoS is possible with a large number of address headers or abnormally large email headers.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of dovecot installed on the remote host is prior to 2.3.21.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-227-01 advisory.

    New dovecot packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the dovecot security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
212357	Amazon Linux 2023 : dovecot, dovecot-devel, dovecot-mysql (ALAS2023-2024-785)	Nessus	Amazon Linux Local Security Checks	medium
207760	AlmaLinux 8 : dovecot (ALSA-2024:6973)	Nessus	Alma Linux Local Security Checks	medium
207707	Oracle Linux 8 : dovecot (ELSA-2024-6973)	Nessus	Oracle Linux Local Security Checks	medium
207688	RHEL 8 : dovecot (RHSA-2024:6973)	Nessus	Red Hat Local Security Checks	medium
207302	Rocky Linux 9 : dovecot (RLSA-2024:6529)	Nessus	Rocky Linux Local Security Checks	medium
207284	Ubuntu 20.04 LTS / 22.04 LTS : Dovecot vulnerabilities (USN-7013-1)	Nessus	Ubuntu Local Security Checks	medium
206991	AlmaLinux 9 : dovecot (ALSA-2024:6529)	Nessus	Alma Linux Local Security Checks	medium
206889	Oracle Linux 9 : dovecot (ELSA-2024-6529)	Nessus	Oracle Linux Local Security Checks	medium
206887	RHEL 9 : dovecot (RHSA-2024:6529)	Nessus	Red Hat Local Security Checks	medium
206785	RHEL 9 : dovecot (RHSA-2024:6465)	Nessus	Red Hat Local Security Checks	medium
206564	SUSE SLES15 / openSUSE 15 Security Update : dovecot23 (SUSE-SU-2024:3118-1)	Nessus	SuSE Local Security Checks	medium
206419	Debian dla-3860 : dovecot-auth-lua - security update	Nessus	Debian Local Security Checks	medium
206416	Ubuntu 24.04 LTS : Dovecot vulnerabilities (USN-6982-1)	Nessus	Ubuntu Local Security Checks	medium
206261	Fedora 39 : dovecot (2024-ba5bb9f63a)	Nessus	Fedora Local Security Checks	medium
206248	Fedora 40 : dovecot (2024-e23e8a3f1e)	Nessus	Fedora Local Security Checks	medium
206014	Debian dsa-5752 : dovecot-auth-lua - security update	Nessus	Debian Local Security Checks	medium
205752	FreeBSD : Dovecot -- DoS (6a6ad6cb-5c6c-11ef-b456-001e676bf734)	Nessus	FreeBSD Local Security Checks	medium
205543	Slackware Linux 15.0 / current dovecot Multiple Vulnerabilities (SSA:2024-227-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2024-23185

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium