{"document":{"aggregate_severity":{"text":"HIGH"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"GREEN","url":"https://www.first.org/tlp/"}},"lang":"en-US","publisher":{"category":"vendor","name":"Open-Xchange GmbH","namespace":"https://open-xchange.com/"},"references":[{"category":"self","summary":"Canonical CSAF document","url":"https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2024/oxdc-adv-2024-0003.json"},{"category":"self","summary":"Markdown representation","url":"https://documentation.open-xchange.com/dovecot/security/advisories/md/2024/oxdc-adv-2024-0003.md"},{"category":"self","summary":"HTML representation","url":"https://documentation.open-xchange.com/dovecot/security/advisories/html/2024/oxdc-adv-2024-0003.html"},{"category":"self","summary":"Plain-text representation","url":"https://documentation.open-xchange.com/dovecot/security/advisories/txt/2024/oxdc-adv-2024-0003.txt"}],"title":"OX Dovecot Pro Security Advisory OXDC-ADV-2024-0003","tracking":{"current_release_date":"2024-09-10T00:00:00+00:00","generator":{"date":"2024-09-10T14:45:00+00:00","engine":{"name":"OX CSAF","version":"1.0.0"}},"id":"OXDC-ADV-2024-0003","initial_release_date":"2024-09-10T00:00:00+02:00","revision_history":[{"date":"2024-09-10T00:00:00+02:00","number":"1","summary":"Initial release"},{"date":"2024-09-10T00:00:00+00:00","number":"2","summary":"Public release"}],"status":"final","version":"2"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"2.3.21","product":{"name":"OX Dovecot Pro core 2.3.21","product_id":"OXDC-CORE_2.3.21","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:dovecot:2.3.21:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"2.3.21.1","product":{"name":"OX Dovecot Pro core 2.3.21.1","product_id":"OXDC-CORE_2.3.21.1","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:dovecot:2.3.21.1:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"3.0.0","product":{"name":"OX Dovecot Pro core 3.0.0","product_id":"OXDC-CORE_3.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:dovecot:3.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"OX Dovecot Pro core"}],"category":"vendor","name":"Open-Xchange GmbH"}]},"vulnerabilities":[{"cve":"CVE-2024-23185","cwe":{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"},"discovery_date":"2024-01-31T11:55:28+01:00","ids":[{"system_name":"JIRA OX Bug","text":"DOV-6601"}],"notes":[{"category":"description","text":"Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up \"full_value\" buffer out of the smaller chunks. The full_value buffer has no size limit, so large headers can cause large memory usage. It doesn't matter whether it's a single long header line, or a single header split into multiple lines. This bug exists in all Dovecot versions."}],"product_status":{"first_fixed":["OXDC-CORE_2.3.21.1","OXDC-CORE_3.0.0"],"last_affected":["OXDC-CORE_2.3.21"]},"remediations":[{"category":"vendor_fix","date":"2024-08-21T08:59:54+02:00","details":"One can implement restrictions on headers on MTA component preceding Dovecot.","product_ids":["OXDC-CORE_2.3.21"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["OXDC-CORE_2.3.21"]}],"threats":[{"category":"impact","details":"Incoming mails typically have some size limits set by MTA, so even largest possible header size may still fit into Dovecot's vsz_limit. So attackers probably can't DoS a victim user this way. A user could APPEND larger mails though, allowing them to DoS themselves (although maybe cause some memory issues for the backend in general)."},{"category":"exploit_status","details":"No publicly available exploits are known."}],"title":"Message headers have no size limit when parsing"}]}