CVE-2015-3420 The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) via vectors related to handshake failures.
MediumCVSS 5.9
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) via vectors related to handshake failures.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/dovecot(Debian:12) | < 1:2.2.13-12 | 1:2.2.13-12 |
| debian/dovecot(Debian:13) | < 1:2.2.13-12 | 1:2.2.13-12 |
| debian/dovecot(Debian:14) | < 1:2.2.13-12 | 1:2.2.13-12 |
| dovecot | <= 2.2.16 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
References
- Debian Security Tracker CVE-2015-3420 vendor-advisory
- FEDORA-2015-7156 third-party-advisory vendor-advisory
- FEDORA-2015-7089 third-party-advisory vendor-advisory
- FEDORA-2015-7159 third-party-advisory vendor-advisory
- [oss-security] 20150427 Re: CVE request: Dovecot remote DoS on TLS connections mailing-list third-party-advisory
- [oss-security] 20150428 Re: Re: CVE request: Dovecot remote DoS on TLS connections mailing-list third-party-advisory
- 74335 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory
- [dovecot-news] 20150513 [Dovecot-news] v2.2.17 released mailing-list vendor-advisory
- [dovecot] 20150424 [patch] TLS Handshake failures can crash imap-login mailing-list vendor-advisory
- bugs.debian.org issue-tracking