dovecot23-2.3.21.1-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:14274-1 Final 1 1 2024-08-20T00:00:00Z current 2024-08-20T00:00:00Z 2024-08-20T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z dovecot23-2.3.21.1-1.1 on GA media These are all security issues fixed in the dovecot23-2.3.21.1-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-14274 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2024-23184/ SUSE CVE CVE-2024-23184 page https://www.suse.com/security/cve/CVE-2024-23185/ SUSE CVE CVE-2024-23185 page openSUSE Tumbleweed dovecot23-2.3.21.1-1.1 dovecot23-backend-mysql-2.3.21.1-1.1 dovecot23-backend-pgsql-2.3.21.1-1.1 dovecot23-backend-sqlite-2.3.21.1-1.1 dovecot23-devel-2.3.21.1-1.1 dovecot23-fts-2.3.21.1-1.1 dovecot23-fts-lucene-2.3.21.1-1.1 dovecot23-fts-solr-2.3.21.1-1.1 dovecot23-fts-squat-2.3.21.1-1.1 dovecot23-2.3.21.1-1.1 as a component of openSUSE Tumbleweed dovecot23-backend-mysql-2.3.21.1-1.1 as a component of openSUSE Tumbleweed dovecot23-backend-pgsql-2.3.21.1-1.1 as a component of openSUSE Tumbleweed dovecot23-backend-sqlite-2.3.21.1-1.1 as a component of openSUSE Tumbleweed dovecot23-devel-2.3.21.1-1.1 as a component of openSUSE Tumbleweed dovecot23-fts-2.3.21.1-1.1 as a component of openSUSE Tumbleweed dovecot23-fts-lucene-2.3.21.1-1.1 as a component of openSUSE Tumbleweed dovecot23-fts-solr-2.3.21.1-1.1 as a component of openSUSE Tumbleweed dovecot23-fts-squat-2.3.21.1-1.1 as a component of openSUSE Tumbleweed Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors sending emails to a victim, this is a security issue. An external attacker can send specially crafted messages that consume target system resources and cause outage. One can implement restrictions on address headers on MTA component preceding Dovecot. No publicly available exploits are known. CVE-2024-23184 openSUSE Tumbleweed:dovecot23-2.3.21.1-1.1 openSUSE Tumbleweed:dovecot23-backend-mysql-2.3.21.1-1.1 openSUSE Tumbleweed:dovecot23-backend-pgsql-2.3.21.1-1.1 openSUSE Tumbleweed:dovecot23-backend-sqlite-2.3.21.1-1.1 openSUSE Tumbleweed:dovecot23-devel-2.3.21.1-1.1 openSUSE Tumbleweed:dovecot23-fts-2.3.21.1-1.1 openSUSE Tumbleweed:dovecot23-fts-lucene-2.3.21.1-1.1 openSUSE Tumbleweed:dovecot23-fts-solr-2.3.21.1-1.1 openSUSE Tumbleweed:dovecot23-fts-squat-2.3.21.1-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-23184.html CVE-2024-23184 https://bugzilla.suse.com/1229184 SUSE Bug 1229184 Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up "full_value" buffer out of the smaller chunks. The full_value buffer has no size limit, so large headers can cause large memory usage. It doesn't matter whether it's a single long header line, or a single header split into multiple lines. This bug exists in all Dovecot versions. Incoming mails typically have some size limits set by MTA, so even largest possible header size may still fit into Dovecot's vsz_limit. So attackers probably can't DoS a victim user this way. A user could APPEND larger mails though, allowing them to DoS themselves (although maybe cause some memory issues for the backend in general). One can implement restrictions on headers on MTA component preceding Dovecot. No publicly available exploits are known. CVE-2024-23185 openSUSE Tumbleweed:dovecot23-2.3.21.1-1.1 openSUSE Tumbleweed:dovecot23-backend-mysql-2.3.21.1-1.1 openSUSE Tumbleweed:dovecot23-backend-pgsql-2.3.21.1-1.1 openSUSE Tumbleweed:dovecot23-backend-sqlite-2.3.21.1-1.1 openSUSE Tumbleweed:dovecot23-devel-2.3.21.1-1.1 openSUSE Tumbleweed:dovecot23-fts-2.3.21.1-1.1 openSUSE Tumbleweed:dovecot23-fts-lucene-2.3.21.1-1.1 openSUSE Tumbleweed:dovecot23-fts-solr-2.3.21.1-1.1 openSUSE Tumbleweed:dovecot23-fts-squat-2.3.21.1-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-23185.html CVE-2024-23185 https://bugzilla.suse.com/1229183 SUSE Bug 1229183