The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3860 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3860-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     September 02, 2024                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : dovecot     Version        : 1:2.3.13+dfsg1-2+deb11u2     CVE ID         : CVE-2024-23184 CVE-2024-23185     Debian Bug     : 1078876 1078877

    Vulnerabilities were discovered in dovecot, an POP3/IMAP server, which     could lead to Denial of Service.

    CVE-2024-23184

        Having a large number of address headers (From, To, Cc, Bcc, etc.)         becomes excessively CPU intensive.

    CVE-2024-23185

        Very large headers can cause resource exhaustion when parsing         message.

    For Debian 11 bullseye, these problems have been fixed in version     1:2.3.13+dfsg1-2+deb11u2.

    We recommend that you upgrade your dovecot packages.

    For the detailed security status of dovecot please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/dovecot

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3860 : dovecot-auth-lua - security update

medium Nessus Plugin ID 206419

Version 1.2