PublicDateAtUSN: 2017-04-10
Candidate: CVE-2017-2669
CRD: 2017-04-10
PublicDate: 2018-06-21 13:29:00 UTC
References: 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2669
 https://ubuntu.com/security/notices/USN-3258-1
 https://ubuntu.com/security/notices/USN-3258-2
Description:
 Dovecot before version 2.2.29 is vulnerable to a denial of service. When
 'dict' passdb and userdb were used for user authentication, the username
 sent by the IMAP/POP3 client was sent through var_expand() to perform
 %variable expansion. Sending specially crafted %variable fields could
 result in excessive memory usage causing the process to crash (and
 restart), or excessive CPU usage causing all authentications to hang.
Ubuntu-Description: 
Notes: 
 tyhicks> Vulnerable versions: 2.2.26 - 2.2.28
Bugs: 
Priority: medium
Discovered-by:
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]

Patches_dovecot:
 upstream: https://github.com/dovecot/core/commit/000030feb7a30f193197f1aab8a7b04a26b42735
upstream_dovecot: needed
precise_dovecot: not-affected
trusty_dovecot: not-affected (1:2.2.9-1ubuntu2.1)
trusty/esm_dovecot: not-affected (1:2.2.9-1ubuntu2.1)
vivid/stable-phone-overlay_dovecot: DNE
vivid/ubuntu-core_dovecot: DNE
xenial_dovecot: not-affected
esm-infra/xenial_dovecot: not-affected
yakkety_dovecot: not-affected (1:2.2.24-1ubuntu1.3)
devel_dovecot: released (2.2.27-2ubuntu2)