{"document":{"aggregate_severity":{"text":"MEDIUM"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"GREEN","url":"https://www.first.org/tlp/"}},"lang":"en-US","publisher":{"category":"vendor","name":"Open-Xchange GmbH","namespace":"https://open-xchange.com/"},"references":[{"category":"self","summary":"Canonical CSAF document","url":"https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2024/oxdc-adv-2024-0002.json"},{"category":"self","summary":"Markdown representation","url":"https://documentation.open-xchange.com/dovecot/security/advisories/md/2024/oxdc-adv-2024-0002.md"},{"category":"self","summary":"HTML representation","url":"https://documentation.open-xchange.com/dovecot/security/advisories/html/2024/oxdc-adv-2024-0002.html"},{"category":"self","summary":"Plain-text representation","url":"https://documentation.open-xchange.com/dovecot/security/advisories/txt/2024/oxdc-adv-2024-0002.txt"}],"title":"OX Dovecot Pro Security Advisory OXDC-ADV-2024-0002","tracking":{"current_release_date":"2024-09-10T00:00:00+00:00","generator":{"date":"2024-09-10T14:33:29+00:00","engine":{"name":"OX CSAF","version":"1.0.0"}},"id":"OXDC-ADV-2024-0002","initial_release_date":"2024-09-10T00:00:00+02:00","revision_history":[{"date":"2024-09-10T00:00:00+02:00","number":"1","summary":"Initial release"},{"date":"2024-09-10T00:00:00+02:00","number":"2","summary":"Public release"},{"date":"2024-09-10T00:00:00+02:00","number":"3","summary":"Public release"},{"date":"2024-09-10T00:00:00+00:00","number":"4","summary":"Public release"}],"status":"final","version":"4"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"2.3.21","product":{"name":"OX Dovecot Pro core 2.3.21","product_id":"OXDC-CORE_2.3.21","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:dovecot:2.3.21:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"2.3.21.1","product":{"name":"OX Dovecot Pro core 2.3.21.1","product_id":"OXDC-CORE_2.3.21.1","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:dovecot:2.3.21.1:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"3.0.0","product":{"name":"OX Dovecot Pro core 3.0.0","product_id":"OXDC-CORE_3.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:dovecot:3.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"OX Dovecot Pro core"}],"category":"vendor","name":"Open-Xchange GmbH"}]},"vulnerabilities":[{"cve":"CVE-2024-23184","cwe":{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"},"discovery_date":"2024-01-30T22:55:25+01:00","ids":[{"system_name":"JIRA OX Bug","text":"DOV-6464"}],"notes":[{"category":"description","text":"Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors sending emails to a victim, this is a security issue."}],"product_status":{"first_fixed":["OXDC-CORE_2.3.21.1","OXDC-CORE_3.0.0"],"last_affected":["OXDC-CORE_2.3.21"]},"remediations":[{"category":"vendor_fix","date":"2024-08-30T11:32:20+02:00","details":"One can implement restrictions on address headers on MTA component preceding Dovecot.","product_ids":["OXDC-CORE_2.3.21"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","version":"3.1"},"products":["OXDC-CORE_2.3.21"]}],"threats":[{"category":"impact","details":"An external attacker can send specially crafted messages that consume target system resources and cause outage."},{"category":"exploit_status","details":"No publicly available exploits are known."}],"title":"Excessive CPU usage with a large number of address headers"}]}