CVE-2017-2669
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb...
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.
- Record
CVE-2017-2669- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2017-11814
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.
- Record
EUVD-2017-11814- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qchv-9m57-q82h
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb...
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.
- Record
GHSA-qchv-9m57-q82h- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.
- Record
CVE-2017-2669- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.
- Record
CVE-2017-2669- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-2669
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.
- Record
DEBIAN-CVE-2017-2669- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2017-2669
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.
- Record
UBUNTU-CVE-2017-2669- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVSUSE-SU-2017:1250-1 No score
Security update for dovecot22
This update for dovecot22 to version 2.2.29.1 fixes the following issues:
This security issue was fixed:
- CVE-2017-2669: Don't double-expand %variables in keys. If dict was used as the authentication passdb, using specially crafted %variables in the username could be used to cause DoS (bsc#1032248)
Additionally stronger SSL default ciphers are now used.
This non-security issue was fixed:
- Remove all references /etc/ssl/certs/. It should not be used anymore (bsc#932386)
More changes are available in the changelog. Please make sure you read README.SUSE after installing this update.
- Record
SUSE-SU-2017:1250-1- Updated
- 2026-11-02
OSVUSN-3258-1 No score
dovecot vulnerability
It was discovered that Dovecot incorrectly handled some usernames. An attacker could possibly use this issue to cause Dovecot to hang or crash, resulting in a denial of service.
- Record
USN-3258-1- Updated
- 2026-11-02
OSVUSN-3258-2 No score
dovecot regression
USN-3258-1 intended to fix a vulnerability in Dovecot. Further investigation revealed that only Dovecot versions 2.2.26 and newer were affected by the vulnerability. Additionally, the change introduced a regression when Dovecot was configured to use the "dict" authentication database. This update reverts the change. We apologize for the inconvenience.
Original advisory details:
It was discovered that Dovecot incorrectly handled some usernames. An attacker could possibly use this issue to cause Dovecot to hang or crash, resulting in a denial of service.
- Record
USN-3258-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dovecotDebian:12 |
before 1:2.2.27-3 | 1:2.2.27-3 |
dovecotDebian:13 |
before 1:2.2.27-3 | 1:2.2.27-3 |
dovecotDebian:14 |
before 1:2.2.27-3 | 1:2.2.27-3 |
dovecotSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 2.2-3.1 | 2.2-3.1 |
dovecot22SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 2.2.29.1-11.1 | 2.2.29.1-11.1 |
dovecot22SUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 2.2.29.1-11.1 | 2.2.29.1-11.1 |
dovecot22SUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 2.2.29.1-11.1 | 2.2.29.1-11.1 |
dovecotSUSE:Linux Enterprise Server 12 SP1 |
before 2.2-3.1 | 2.2-3.1 |
dovecot22SUSE:Linux Enterprise Server 12 SP1 |
before 2.2.29.1-11.1 | 2.2.29.1-11.1 |
dovecotSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 2.2-3.1 | 2.2-3.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dovecot22SUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 2.2.29.1-11.1 | 2.2.29.1-11.1 |
dovecotSUSE:Linux Enterprise Server 12 SP2 |
before 2.2-3.1 | 2.2-3.1 |
dovecot22SUSE:Linux Enterprise Server 12 SP2 |
before 2.2.29.1-11.1 | 2.2.29.1-11.1 |
dovecotSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 2.2-3.1 | 2.2-3.1 |
dovecot22SUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 2.2.29.1-11.1 | 2.2.29.1-11.1 |
dovecotUbuntu:16.04:LTS |
before 1:2.2.22-1ubuntu2.3, plus listed versions 1:2.2.18-2ubuntu21:2.2.22-1ubuntu11:2.2.22-1ubuntu21:2.2.22-1ubuntu2.11:2.2.22-1ubuntu2.2 |
1:2.2.22-1ubuntu2.3 |
dovecotUbuntu:16.04:LTS |
before 1:2.2.22-1ubuntu2.4, plus listed versions 1:2.2.18-2ubuntu21:2.2.22-1ubuntu11:2.2.22-1ubuntu21:2.2.22-1ubuntu2.11:2.2.22-1ubuntu2.21:2.2.22-1ubuntu2.3 |
1:2.2.22-1ubuntu2.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-2669 is a low vulnerability (CVSS 3.7) in [unknown] Dovecot, published April 10, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.31%, the 91st percentile. Fixed in dovecot 1:2.2.27-3.
References
dovecot.org/pipermail/dovecot-news/2017-April/000341.html
openwall.com/lists/oss-security/2017/04/11/1
bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2669
github.com/dovecot/core/commit/000030feb7a30f193197f1aab8a7b04a26b42735.patch
debian.org/security/2017/dsa-3828
securityfocus.com/bid/97536
Show 12 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-2669
security-tracker.debian.org/tracker/CVE-2017-2669
suse.com/support/update/announcement/2017/suse-su-20171250-1
bugzilla.suse.com/1032248
ubuntu.com/security/CVE-2017-2669
cve.org/CVERecord?id=CVE-2017-2669