| Summary: | <net-mail/dovecot-{2.2.33.2-r1,2.3.0-r2}: auth client leaks memory if SASL authentication is aborted (CVE-2017-15132) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Thomas Deutschmann (RETIRED) <whissi> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | arthur, eras, net-mail+disabled, robbat2 |
| Priority: | Low | Flags: | stable-bot:
sanity-check+
|
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://seclists.org/oss-sec/2018/q1/100 | ||
| Whiteboard: | B4 [noglsa cve] | ||
| Package list: |
=net-mail/dovecot-2.2.33.2-r2
=app-text/libexttextcat-3.4.5 ia64
|
Runtime testing required: | --- |
|
Description
Thomas Deutschmann (RETIRED)
2018-01-11 17:12:28 UTC
Score: 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected versions: 2.0 up to 2.2.33 and 2.3.0 Fixed versions: 2.2.34 (not released yet), 2.3.1 (not released yet) We have identified a memory leak in Dovecot auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion. Patch to apply this issue can be found from https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060.patch To our best knowledge, this patch should apply to all versions. This issue can be mitigated on vulnerably systems by limiting login process to single request per process, which is also the default value. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=77ef1e767f97fa8377c4e2467082bacbb303d333 commit 77ef1e767f97fa8377c4e2467082bacbb303d333 Author: Thomas Deutschmann <whissi@gentoo.org> AuthorDate: 2018-01-25 15:19:25 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2018-01-25 15:19:40 +0000 net-mail/dovecot: bump, fixes CVE-2017-15132 Bug: https://bugs.gentoo.org/644214 Package-Manager: Portage-2.3.20, Repoman-2.3.6 Signed-off-by: Robin H. Johnson <robbat2@gentoo.org> net-mail/dovecot/dovecot-2.2.33.2-r1.ebuild | 291 +++++++++++++++++++++ net-mail/dovecot/dovecot-2.3.0-r2.ebuild | 286 ++++++++++++++++++++ .../files/dovecot-2.2.33.2-CVE-2017-15132.patch | 14 + 3 files changed, 591 insertions(+)} @ Arches, please test and mark stable: =net-mail/dovecot-2.2.33.2-r1 An automated check of this bug failed - repoman reported dependency errors (7 lines truncated):
> dependency.bad net-mail/dovecot/dovecot-2.2.33.2-r1.ebuild: DEPEND: ia64(default/linux/ia64/17.0) ['app-text/libexttextcat']
> dependency.bad net-mail/dovecot/dovecot-2.2.33.2-r1.ebuild: RDEPEND: ia64(default/linux/ia64/17.0) ['app-text/libexttextcat']
> dependency.bad net-mail/dovecot/dovecot-2.2.33.2-r1.ebuild: DEPEND: ia64(default/linux/ia64/17.0/desktop) ['app-text/libexttextcat']
@ IA64 AT: Either stabilize =app-text/libexttextcat-3.4.5 or set package.use.mask for "textcat" USE flag. x86 stable ia64 stable amd64 stable The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e3acd4d22b48eca30b27ce4694e4ae1de51fba40 commit e3acd4d22b48eca30b27ce4694e4ae1de51fba40 Author: Thomas Deutschmann <whissi@gentoo.org> AuthorDate: 2018-02-01 01:18:17 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2018-02-01 01:18:17 +0000 net-mail/dovecot: bump, fixup for problem caused by patch for CVE-2017-15132 Dovecot login process would crash after few minutes of idle after consecutive aborted logins when patch for CVE-2017-15132 was applied. Bug: https://bugs.gentoo.org/644214 Package-Manager: Portage-2.3.21, Repoman-2.3.6 net-mail/dovecot/dovecot-2.2.33.2-r2.ebuild | 292 +++++++++++++++++++++ net-mail/dovecot/dovecot-2.3.0-r3.ebuild | 289 ++++++++++++++++++++ .../dovecot-2.2.33.2-CVE-2017-15132-fixup.patch | 37 +++ 3 files changed, 618 insertions(+)} Restarting stabilization with =net-mail/dovecot-2.2.33.2-r2. See http://seclists.org/oss-sec/2018/q1/119. amd64 stable x86 stable ia64 stable arm stable Superseded by bug 648894. cleanup will happen in bug #648894 |
