Bug 1701216 (CVE-2019-10691) - CVE-2019-10691 dovecot: Mishandling invalid UTF-8 characters by JSON encoder leading to possible DoS attack.
Summary: CVE-2019-10691 dovecot: Mishandling invalid UTF-8 characters by JSON encoder ...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2019-10691
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1701218
Blocks: 1701220
TreeView+ depends on / blocked
 
Reported: 2019-04-18 12:00 UTC by Marian Rehak
Modified: 2021-02-16 22:05 UTC (History)
5 users (show)

Fixed In Version: dovecot 2.3.5.2
Clone Of:
Environment:
Last Closed: 2019-04-22 06:04:26 UTC
Embargoed:


Attachments (Terms of Use)

Description Marian Rehak 2019-04-18 12:00:25 UTC
JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters. Attacker can repeatedly crash Dovecot authentication process by logging in using invalid UTF-8 sequence in username. Crash can also occur if OX push notification driver is enabled and an email is delivered with invalid UTF-8 sequence in From or Subject header.

External References:
https://dovecot.org/list/dovecot-news/2019-April/000406.html

Comment 1 Marian Rehak 2019-04-18 12:01:21 UTC
Created dovecot tracking bugs for this issue:

Affects: fedora-all [bug 1701218]

Comment 2 Huzaifa S. Sidhpurwala 2019-04-22 05:54:56 UTC
Upstream commit: https://github.com/dovecot/core/commit/973769d74433de3c56c4ffdf4f343cb35d98e4f7

Comment 3 Huzaifa S. Sidhpurwala 2019-04-22 06:04:29 UTC
Statement:

A flaw was found in the JSON encoder in dovecot, which an attacker could use to crash the application via usage of invalid UTF-8 characters in the login name during authentication or by using invalid UTF-8 sequence in email when OX push notification driver is enabled. The versions of dovecot shipped with Red Hat Enterprise Linux did not ship the vulnerable code and therefore were not affected by this flaw.


Note You need to log in before you can comment on or make changes to this bug.