CVE-2024-23184

Publication date 24 August 2024

Last updated 16 September 2024

Ubuntu priority

Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors sending emails to a victim, this is a security issue. An external attacker can send specially crafted messages that consume target system resources and cause outage. One can implement restrictions on address headers on MTA component preceding Dovecot. No publicly available exploits are known.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
dovecot	24.04 LTS noble	Fixed 1:2.3.21+dfsg1-2ubuntu6
	22.04 LTS jammy	Fixed 1:2.3.16+dfsg1-3ubuntu2.4
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected

Notes

mdeslaur

introduced in 2.3.10 by: https://github.com/dovecot/core/commit/469fcd3bdd7df40bb8f4d131121f3bfbceade02a

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
dovecot	Upstream: 8e4c42d Upstream: cee0820 Upstream: 0bae091 Upstream: a1c9b04 Upstream: da61d20 Upstream: 1481c04

CVE-2024-23184

Status

Notes

mdeslaur

Patch details

References

Related Ubuntu Security Notices (USN)

Other references