CVE-2017-2669
Publication date 10 April 2017
Last updated 25 August 2025
Ubuntu priority
Description
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| dovecot | ||
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
|
Notes
Severity score breakdown
CVSS version: CVSS v3.0
Base score
7.5 · High
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-3258-1
- Dovecot vulnerability
- 10 April 2017
- USN-3258-2
- Dovecot regression
- 11 April 2017