CVE-2017-15132

A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.

References

Affected packages

Git / github.com/dovecot/core

Affected ranges

Type

GIT

Repo

https://github.com/dovecot/core

Events

Introduced

5d5c4f2bfb812c767084c0338dae692db476da10

Last affected

68b0a183ed4d86c3ec05b8fdfbf6f771af799e0c

Introduced

Last affected

c8b89eb9968980589904a58e8bd72fc8c00039be

Fixed

1a29ed2f96da1be22fa5a4d96c7583aa81b8b060

Database specific

{
    "versions": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.2.33"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.3.0"
        }
    ]
}

Affected versions

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.1.alpha1

2.1.alpha2

2.1.beta1

2.1.rc1

2.1.rc2

2.1.rc3

2.1.rc4

2.1.rc5

2.1.rc6

2.2.0

2.2.1

2.2.10

2.2.11

2.2.12

2.2.13

2.2.13.rc1

2.2.14

2.2.14.rc1

2.2.15

2.2.16

2.2.16.rc1

2.2.17

2.2.17.rc1

2.2.17.rc2

2.2.18

2.2.19

2.2.19.rc1

2.2.19.rc2

2.2.2

2.2.20

2.2.20.rc1

2.2.3

2.2.33

2.2.33.rc1

2.2.4

2.2.5

2.2.6

2.2.7

2.2.8

2.2.9

2.2.alpha1

2.2.beta1

2.2.beta2

2.2.rc1

2.2.rc2

2.2.rc3

2.2.rc4

2.2.rc5

2.2.rc6

2.2.rc7

2.3.0

2.3.0.rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15132.json"

vanir_signatures_modified

"2026-04-11T04:47:48Z"

vanir_signatures

[
    {
        "target": {
            "file": "src/lib-auth/auth-client-request.c",
            "function": "auth_client_request_abort"
        },
        "id": "CVE-2017-15132-b5687e0c",
        "source": "https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060",
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 189.0,
            "function_hash": "215630281052956561789486511243423684996"
        },
        "signature_version": "v1"
    },
    {
        "target": {
            "file": "src/lib-auth/auth-client-request.c"
        },
        "id": "CVE-2017-15132-da78e4dc",
        "source": "https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060",
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "256845835522410639369354571979945330357",
                "50071296302481837651153587836823008511",
                "155824037022152075349161589285698475531",
                "309589516607185628648135646432823813963"
            ]
        },
        "signature_version": "v1"
    }
]

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "14.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "16.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "17.10"
            }
        ]
    }
]