CVE-2017-15132

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-15132
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15132.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-15132
Downstream
ALPINE (1)
CLEANSTART (1)
CLSA (2)
DEBIAN (1)
MGASA (1)
openSUSE (2)
SUSE (1)
UBUNTU (1)
Related
openSUSE (2)
SUSE (1)
Published
2018-01-25T20:29:00Z
Modified
2026-10-20T13:20:28Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "12.04"
                        },
                        {
                            "last_affected": "12.04"
                        },
                        {
                            "introduced": "14.04"
                        },
                        {
                            "last_affected": "14.04"
                        },
                        {
                            "introduced": "16.04"
                        },
                        {
                            "last_affected": "16.04"
                        },
                        {
                            "introduced": "17.10"
                        },
                        {
                            "last_affected": "17.10"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "canonical:ubuntu_linux"
        },
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "7.0"
                        },
                        {
                            "last_affected": "7.0"
                        },
                        {
                            "introduced": "8.0"
                        },
                        {
                            "last_affected": "8.0"
                        },
                        {
                            "introduced": "9.0"
                        },
                        {
                            "last_affected": "9.0"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "debian:debian_linux"
        }
    ]
}
References

Affected packages

Git / github.com/dovecot/core

Affected ranges

Type
GIT
Repo
https://github.com/dovecot/core
Events
Introduced
5d5c4f2bfb812c767084c0338dae692db476da10
Last Affected
68b0a183ed4d86c3ec05b8fdfbf6f771af799e0c
Introduced
c8b89eb9968980589904a58e8bd72fc8c00039be
Last Affected
c8b89eb9968980589904a58e8bd72fc8c00039be
Fixed
1a29ed2f96da1be22fa5a4d96c7583aa81b8b060
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "last_affected": "2.2.33"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:dovecot:dovecot:2.3.0:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.3.0"
                },
                {
                    "last_affected": "2.3.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "range": [
                {
                    "fixed": "1a29ed2f96da1be22fa5a4d96c7583aa81b8b060"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.1.alpha1
2.1.alpha2
2.1.beta1
2.1.rc1
2.1.rc2
2.1.rc3
2.1.rc4
2.1.rc5
2.1.rc6
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.13.rc1
2.2.14
2.2.14.rc1
2.2.15
2.2.16
2.2.16.rc1
2.2.17
2.2.17.rc1
2.2.17.rc2
2.2.18
2.2.19
2.2.19.rc1
2.2.19.rc2
2.2.2
2.2.20
2.2.20.rc1
2.2.3
2.2.33
2.2.33.rc1
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.2.alpha1
2.2.beta1
2.2.beta2
2.2.rc1
2.2.rc2
2.2.rc3
2.2.rc4
2.2.rc5
2.2.rc6
2.2.rc7
2.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15132.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "215630281052956561789486511243423684996",
            "length": 189
        },
        "id": "CVE-2017-15132-b5687e0c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060",
        "target": {
            "file": "src/lib-auth/auth-client-request.c",
            "function": "auth_client_request_abort"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "256845835522410639369354571979945330357",
                "50071296302481837651153587836823008511",
                "155824037022152075349161589285698475531",
                "309589516607185628648135646432823813963"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2017-15132-da78e4dc",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060",
        "target": {
            "file": "src/lib-auth/auth-client-request.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-20T13:20:28Z"