Bug 641276 (CVE-2010-3780)
Summary: | CVE-2010-3780 Dovecot: Busy master process, receiving a lot of SIGCHLD signals rapidly while logging, could die | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Jan Lieskovsky <jlieskov> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | Ales Zelinka <azelinka> |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | azelinka, kvolny, mhlavink, wnefal+redhatbugzilla |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2011-05-19 14:04:36 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 654226 | ||
Bug Blocks: |
Description
Jan Lieskovsky
2010-10-08 08:49:25 UTC
This issue did NOT affect the versions of the dovecot package, as shipped with Red Hat Enterprise Linux 4 and 5. -- This issue does NOT affect the versions of the dovecot package, as shipped with Fedora release of 12 and 13 (relevant packages are already updated). do we have any realiable reproducer? - "Dovecot master process *could have* died if ..." doesn't sound too convincing to me (In reply to comment #4) > do we have any realiable reproducer? - "Dovecot master process *could have* > died if ..." doesn't sound too convincing to me I'm not aware of such reliable reproducer. You'll need to have a lot of connections at the same time (in theory 3, but not with idle master process) and still there's only (medium) chance, no guarantee. (In reply to comment #5) > (In reply to comment #4) > > do we have any realiable reproducer? - "Dovecot master process *could have* > > died if ..." doesn't sound too convincing to me > > I'm not aware of such reliable reproducer. You'll need to have a lot of > connections at the same time (in theory 3, but not with idle master process) > and still there's only (medium) chance, no guarantee. thanks for the info so this'd be SanityOnly, no testcase will be written This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:0600 https://rhn.redhat.com/errata/RHSA-2011-0600.html |