As reported on oss-sec :
There's an upper limit to how many IMAP/POP3 connections can exist that haven't logged in (and separate
limits for post-login). Normally when this limit is reached, the oldest connection gets disconnected.
There is of course some potential to try to DoS Dovecot by doing a lot of IMAP/POP3 connections, but because
the oldest connection always gets destroyed this requires quite a lot of activity from the attacker.
This "destroy oldest connection" however hasn't been working in v1.1+ releases for connections that have
started SSL/TLS handshake, but haven't finished it. So an attacker could just do a bunch of TCP
connections to port 993 and leave them hanging around and Dovecot would pretty quickly reach the upper
limit without being able to disconnect any of the oldest connections.
Here are patches to fix this:
The fix will be in v2.2.13. Maybe also in v2.1.18 if I decide to release it. For older releases you need to
patch it yourself.
For people who are using dovecot-ee releases the fix is also in v184.108.40.206 and v220.127.116.11 releases.
Created dovecot tracking bugs for this issue:
Affects: fedora-all [bug 1096408]
Is there going to be an update for the RHEL package?
dovecot-2.2.13-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
dovecot-2.2.13-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Via RHSA-2014:0790 https://rhn.redhat.com/errata/RHSA-2014-0790.html
Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.