This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Dovecot fixes 2 vulnerabilities
Dovecot (an IMAP and POP3 server) fixes 2 vulnerabilities in version 2.3.21.1 [1].
An unauthenticated remote attacker can carry out a DoS attack by sending e-mails with very large headers [2].
The vulnerability is present in product:
- Dovecot; <2.3.21.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-23185 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 14. 8. 2024.
An unauthenticated remote attacker can carry out a DoS attack by sending e-mails with a large number of addresses in the header [3][4].
The vulnerability is present in product:
- Dovecot; <2.3.21.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-23184 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 14. 8. 2024.
Links
By CESNET, z.s.p.o. Martin Krajči on 19. 8. 2024.