CVE-2017-15130
- State
- Published
- Severity
- Not scored
- Published
- Mar 2, 2018
- Updated
- Sep 16, 2024
- Reserved
- Oct 8, 2017
Description
A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.
Scores
The record has no CVSS score.
Weaknesses
Affected Products
| Product | Versions |
|---|---|
dovecotThe Dovecot Project |
|
References
- USN-3587-1vendor-advisory
- [oss-security] 20180301 Dovecot Security Advisory: CVE-2017-15130 TLS SNI config lookups are inefficient and can be used for DoSmailing-list
- [debian-lts-announce] 20180331 [SECURITY] [DLA 1333-1] dovecot security updatemailing-list
- DSA-4130vendor-advisory
- USN-3587-2vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1532356
- [dovecot-news] 20180228 v2.2.34 releasedmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.