NVD Vulnerability Detail

CVE-2017-15132

Summary	A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.
Publication Date	Jan. 26, 2018, 5:29 a.m.
Registration Date	Jan. 26, 2021, 1:16 p.m.
Last Update	Nov. 21, 2024, 12:14 p.m.

Affected software configurations

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:12.04::::esm:::
cpe:2.3:o:canonical:ubuntu_linux:17.10:::::::*

Related information, measures and tools

No	URL	タグ
1	https://bugzilla.redhat.com/show_bug.cgi?id=1532768	Issue Tracking Patch Third Party Advisory
2	https://bugzilla.redhat.com/show_bug.cgi?id=1532768	Issue Tracking Patch Third Party Advisory
3	https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060.patch	Patch Third Party Advisory
4	https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060.patch	Patch Third Party Advisory
5	https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html	Mailing List Third Party Advisory
6	https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html	Mailing List Third Party Advisory
7	https://usn.ubuntu.com/3556-1/	Third Party Advisory
8	https://usn.ubuntu.com/3556-1/	Third Party Advisory
9	https://usn.ubuntu.com/3556-2/	Third Party Advisory
10	https://usn.ubuntu.com/3556-2/	Third Party Advisory
11	https://www.debian.org/security/2018/dsa-4130	Third Party Advisory
12	https://www.debian.org/security/2018/dsa-4130	Third Party Advisory
13	https://www.dovecot.org/list/dovecot-news/2018-February/000370.html	Vendor Advisory
14	https://www.dovecot.org/list/dovecot-news/2018-February/000370.html	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-772	有効なライフタイム後のリソースの解放の欠如	https://cwe.mitre.org/data/definitions/772.html

JVN Vulnerability Information

dovecot における認証に関する脆弱性

Title	dovecot における認証に関する脆弱性
Summary	dovecot には、認証に関する脆弱性、およびリソース管理に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 18, 2017, midnight
Registration Date	Feb. 26, 2018, 4:36 p.m.
Last Update	Feb. 26, 2018, 4:36 p.m.

Affected System

Timo Sirainen

Dovecot 2.0 から 2.2.33

Dovecot 2.3.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-15132	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15132
National Vulnerability Database (NVD)
2	CVE-2017-15132	https://nvd.nist.gov/vuln/detail/CVE-2017-15132

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-287	https://jvndb.jvn.jp/ja/cwe/CWE-287.html
2	CWE-399	https://jvndb.jvn.jp/ja/cwe/CWE-399.html

ベンダー情報

No	Name	URL
GitHub
1	[PATCH] lib-auth: Fix memory leak in auth_client_request_abort()	https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060.patch
Red Hat Bugzilla
2	Bug 1532768	https://bugzilla.redhat.com/show_bug.cgi?id=1532768

Change Log

No	Changed Details	Date of change
1	[2018年02月26日] 掲載	Feb. 26, 2018, 4:36 p.m.