Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 515
Alerts This Week
Warning Icon 1 515

Fedora 40: FEDORA-2024-e23e8a3f1e Medium: Dovecot CPU Usage

fedora
Calendar Grey August 28, 2024
Scroller Fedora
Ubuntu 22.04 Postfix security patches manage disk usage in mail queues and impose restrictions for optimal performance.
CVE-2024-23184: A large number of address headers in email resulted in excessive CPU usage

Summary

Dovecot is an IMAP server for Linux/UNIX-like systems, written with security

primarily in mind. It also contains a small POP3 server. It supports mail

in either of maildir or mbox formats.

The SQL drivers and authentication plug-ins are in their subpackages.

Update Information:

CVE-2024-23184: A large number of address headers in email resulted in excessive CPU usage. CVE-2024-23185: Abnormally large email headers are now truncated or discarded, with a limit of 10MB on a single header and 50MB for all the headers of all the parts of an email.

Topics%20covered

Topics Covered

security advisory Fedora email security Dovecot email headers CPU load size limit

Change Log

* Mon Aug 19 2024 Michal Hlavinka - 1:2.3.21.1-1 - updated to 2.3.21.1(2304907) * Wed Jul 17 2024 Fedora Release Engineering - 1:2.3.21-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild * Tue Jun 18 2024 Michal Hlavinka - 1:2.3.21-8 - fix sieve crash when there are two missing optional scripts - Do not use deprecated OpenSSL v3 ENGINE API - Drop dependency on libstemmer on RHEL * Tue Mar 26 2024 Michal Hlavinka - 1:2.3.21-7 - drop i686 build as per https://fedoraproject.org/wiki/Changes/EncourageI686LeafRemoval

References

Fedora Update Notification FEDORA-2024-e23e8a3f1e 2024-08-28 02:35:34.688486 Name : dovecot Product : Fedora 40 Version : 2.3.21.1 Release : 1.fc40 URL : https://dovecot.org/ Summary : Secure imap and pop3 server Description : Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are in their subpackages.

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-e23e8a3f1e' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
medium
Lowest
Low
Medium
High
Critical

Name: dovecot
Product: Fedora 40
Version: 2.3.21.1
Release: 1.fc40
URL: https://dovecot.org/
Summary: Secure imap and pop3 server

Topics%20covered

Topics Covered

security advisory Fedora email security Dovecot email headers CPU load size limit

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.