CVE-2014-3430

Priority
Medium
Description
Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before
2.2.12.12 does not properly close old connections, which allows remote
attackers to cause a denial of service (resource consumption) via an
incomplete SSL/TLS handshake for an IMAP/POP3 connection.
References
Bugs
Assigned-to
mdeslaur
Package
Upstream:released (1:2.2.13~rc1-1)
Ubuntu 10.04 LTS (Lucid Lynx):released (1:1.2.9-1ubuntu6.6)
Ubuntu 12.04 LTS (Precise Pangolin):released (1:2.0.19-0ubuntu2.1)
Ubuntu 12.10 (Quantal Quetzal):released (1:2.1.7-1ubuntu2.1)
Ubuntu 13.10 (Saucy Salamander):released (1:2.1.7-7ubuntu3.1)
Ubuntu 14.04 LTS (Trusty Tahr):released (1:2.2.9-1ubuntu2.1)
Ubuntu 14.10 (Utopic Unicorn):released (1:2.2.9-1ubuntu3)
Patches:
Upstream:http://hg.dovecot.org/dovecot-2.2/rev/41622541a7a3
Upstream:http://hg.dovecot.org/dovecot-2.1/rev/b7ac23b4d339
Upstream:http://hg.dovecot.org/dovecot-2.0/rev/48f90e7e92dc
Upstream:http://hg.dovecot.org/dovecot-1.2/rev/8ba4253adc9b
More Information

Valid XHTML 1.0 Strict

Updated: 2014-05-16 03:14:42 UTC (commit 8064)