Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up "fullvalue" buffer out of the smaller chunks. The fullvalue buffer has no size limit, so large headers can cause large memory usage. It doesn't matter whether it's a single long header line, or a single header split into multiple lines. This bug exists in all Dovecot versions. Incoming mails typically have some size limits set by MTA, so even largest possible header size may still fit into Dovecot's vsz_limit. So attackers probably can't DoS a victim user this way. A user could APPEND larger mails though, allowing them to DoS themselves (although maybe cause some memory issues for the backend in general). One can implement restrictions on headers on MTA component preceding Dovecot. No publicly available exploits are known.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "dovecot-auth-lua", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-auth-lua-dbgsym", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-core", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-core-dbgsym", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-dev", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-gssapi", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-gssapi-dbgsym", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-imapd", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-imapd-dbgsym", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-ldap", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-ldap-dbgsym", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-lmtpd", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-lmtpd-dbgsym", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-lucene", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-lucene-dbgsym", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-managesieved", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-managesieved-dbgsym", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-mysql", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-mysql-dbgsym", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-pgsql", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-pgsql-dbgsym", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-pop3d", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-pop3d-dbgsym", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-sieve", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-sieve-dbgsym", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-solr", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-solr-dbgsym", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-sqlite", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-sqlite-dbgsym", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-submissiond", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "dovecot-submissiond-dbgsym", "binary_version": "1:2.3.7.2-1ubuntu3.7" }, { "binary_name": "mail-stack-delivery", "binary_version": "1:2.3.7.2-1ubuntu3.7" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "dovecot-auth-lua", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-auth-lua-dbgsym", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-core", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-core-dbgsym", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-dev", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-gssapi", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-gssapi-dbgsym", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-imapd", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-imapd-dbgsym", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-ldap", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-ldap-dbgsym", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-lmtpd", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-lmtpd-dbgsym", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-lucene", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-lucene-dbgsym", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-managesieved", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-managesieved-dbgsym", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-mysql", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-mysql-dbgsym", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-pgsql", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-pgsql-dbgsym", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-pop3d", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-pop3d-dbgsym", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-sieve", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-sieve-dbgsym", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-solr", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-solr-dbgsym", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-sqlite", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-sqlite-dbgsym", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-submissiond", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" }, { "binary_name": "dovecot-submissiond-dbgsym", "binary_version": "1:2.3.16+dfsg1-3ubuntu2.4" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "dovecot-auth-lua", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-auth-lua-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-core", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-core-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-dev", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-gssapi", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-gssapi-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-imapd", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-imapd-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-ldap", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-ldap-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-lmtpd", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-lmtpd-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-managesieved", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-managesieved-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-mysql", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-mysql-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-pgsql", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-pgsql-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-pop3d", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-pop3d-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-sieve", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-sieve-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-solr", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-solr-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-sqlite", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-sqlite-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-submissiond", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-submissiond-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "dovecot-auth-lua", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-auth-lua-dbgsym", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-core", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-core-dbgsym", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-dev", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-gssapi", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-gssapi-dbgsym", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-imapd", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-imapd-dbgsym", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-ldap", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-ldap-dbgsym", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-lmtpd", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-lmtpd-dbgsym", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-managesieved", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-managesieved-dbgsym", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-mysql", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-mysql-dbgsym", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-pgsql", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-pgsql-dbgsym", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-pop3d", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-pop3d-dbgsym", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-sieve", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-sieve-dbgsym", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-solr", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-solr-dbgsym", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-sqlite", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-sqlite-dbgsym", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-submissiond", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" }, { "binary_name": "dovecot-submissiond-dbgsym", "binary_version": "1:2.3.21+dfsg1-2ubuntu6" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "dovecot-auth-lua", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-auth-lua-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-core", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-core-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-dev", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-gssapi", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-gssapi-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-imapd", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-imapd-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-ldap", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-ldap-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-lmtpd", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-lmtpd-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-managesieved", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-managesieved-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-mysql", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-mysql-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-pgsql", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-pgsql-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-pop3d", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-pop3d-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-sieve", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-sieve-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-solr", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-solr-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-sqlite", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-sqlite-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-submissiond", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" }, { "binary_name": "dovecot-submissiond-dbgsym", "binary_version": "1:2.3.21.1+dfsg1-1ubuntu1" } ] }