{"id":"CVE-2017-15130","aliases":["ALPINE-CVE-2017-15130","DEBIAN-CVE-2017-15130","DLA-1333-1","DSA-4130-1","EUVD-2017-6591","GHSA-36px-qc55-gxh7","MGASA-2018-0160","SUSE-SU-2018:2632-1","SUSE-SU-2018:2632-2","UBUNTU-CVE-2017-15130","USN-3587-1","openSUSE-SU-2024:10726-1","openSUSE-SU-2025:14715-1"],"status":"published","title":"A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random...","description":"A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02553,"percentile":0.8516,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2018-02-28T00:00:00Z","modified":"2026-10-24T10:30:39Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"dovecot","fixed_in":["2.2.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"dovecot","fixed_in":["1:2.2.34-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dovecot","fixed_in":["1:2.2.34-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dovecot","fixed_in":["1:2.2.34-1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"dovecot22","fixed_in":["2.2.31-19.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"dovecot22","fixed_in":["2.2.31-19.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"dovecot22","fixed_in":["2.2.31-19.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"dovecot22","fixed_in":["2.2.31-19.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"dovecot22","fixed_in":["2.2.31-19.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"dovecot22","fixed_in":["2.2.31-19.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"dovecot22","fixed_in":["2.2.31-19.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"dovecot22","fixed_in":["2.2.31-19.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"dovecot22","fixed_in":["2.2.31-19.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"dovecot22","fixed_in":["2.2.31-19.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"dovecot22","fixed_in":["2.2.31-19.11.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"dovecot","fixed_in":["1:2.2.9-1ubuntu2.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","fixed_in":["1:2.2.22-1ubuntu2.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.34-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.34-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.34-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.7-7+deb7u2"}]}],"versions":["1:2.1.7-7","1:2.1.7-7+deb7u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.13-12~deb8u4"}]}],"versions":["1:2.2.13-11","1:2.2.13-12~deb8u1","1:2.2.13-12~deb8u2","1:2.2.13-12~deb8u3"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.27-3+deb9u2"}]}],"versions":["1:2.2.27-3","1:2.2.27-3+deb9u1","1:2.2.27-3+deb9u2~bpo8+1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.34-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.11.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.9-1ubuntu2.4"}]}],"versions":["1:2.1.7-7ubuntu3","1:2.2.9-1ubuntu1","1:2.2.9-1ubuntu2","1:2.2.9-1ubuntu2.1","1:2.2.9-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.22-1ubuntu2.7"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2","1:2.2.22-1ubuntu2.3","1:2.2.22-1ubuntu2.4","1:2.2.22-1ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.9-1ubuntu2.4"}]}],"versions":["1:2.1.7-7ubuntu3","1:2.2.9-1ubuntu1","1:2.2.9-1ubuntu2","1:2.2.9-1ubuntu2.1","1:2.2.9-1ubuntu2.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.22-1ubuntu2.7"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2","1:2.2.22-1ubuntu2.3","1:2.2.22-1ubuntu2.4","1:2.2.22-1ubuntu2.6"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.16-1.6"}]}],"bundled":22},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.1"}]}],"bundled":24}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"dovecot","product":"dovecot"},{"vendor":"the dovecot project","product":"dovecot"}],"references":[{"url":"https://usn.ubuntu.com/3587-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://seclists.org/oss-sec/2018/q1/205","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.debian.org/security/2018/dsa-4130","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3587-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1532356","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://www.dovecot.org/list/dovecot-news/2018-February/000370.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15130"},{"url":"https://github.com/advisories/GHSA-36px-qc55-gxh7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-15130","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-15130","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0160.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22673","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2018/03/01/2","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2018/03/01/3","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182632-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082828","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15130","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182632-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-15130","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2018/03/01/3","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3587-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3587-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14461","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33515","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KZSDCZ5LA6IHY7KXVSL6ULAJVP6OFT2M/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23185","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-15130","description":"A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.","status":"published","published":"2018-03-02T15:00:00Z","modified":"2024-09-16T20:17:43.957Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:33:14.271248Z"}],"euvd":[{"id":"EUVD-2017-6591","description":"A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.","status":"published","published":"2018-03-02T15:00:00Z","modified":"2024-09-16T20:17:43Z","updated_at":"2026-11-03T00:55:15.039746Z"}],"ghsa":[{"id":"GHSA-36px-qc55-gxh7","title":"A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random...","description":"A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.","status":"published","published":"2022-05-13T01:43:37Z","modified":"2023-02-02T05:00:57Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T14:51:04.884002Z"}],"nvd":[{"id":"CVE-2017-15130","description":"A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.","status":"published","published":"2018-03-02T15:29:00.273Z","modified":"2026-06-17T01:07:18.17Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:04:15.877386Z"}],"osv":[{"id":"ALPINE-CVE-2017-15130","description":"A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.","status":"published","published":"2018-03-02T15:29:00.273Z","modified":"2026-06-15T18:18:06.784797473Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-15130","description":"A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.","status":"published","published":"2018-03-02T15:29:00.273Z","modified":"2026-10-24T10:30:39.390326604Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"DEBIAN-CVE-2017-15130","description":"A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.","status":"published","published":"2018-03-02T15:29:00.273Z","modified":"2026-09-01T20:03:44.395046994Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"UBUNTU-CVE-2017-15130","description":"A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.","status":"published","published":"2018-02-28T00:00:00Z","modified":"2026-04-22T11:17:45.243685Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"DLA-1333-1","title":"dovecot - security update","status":"published","published":"2018-03-31T00:00:00Z","modified":"2026-03-09T01:01:08.98492Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4130-1","title":"dovecot - security update","status":"published","published":"2018-03-02T00:00:00Z","modified":"2026-03-09T01:19:52.400799Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0160","title":"Updated dovecot packages fix security vulnerabilities","description":"Dovecot has been updated to version 2.2.34 to fix two security issues.\n\nCVE-2017-14461:\nThis vulnerability comes in two flavors. A malicious party can send a\nspecially crafted email to a vulnerable system, causing it to crash\ndovecot. In some systems, the mail can be stored into the mail system, \ncausing crash every time it is being opened.\n\nCVE-2017-15130:\nIf dovecot has been configured with local name or local net\nconfiguration blocks, SNI lookups can be used to trash memory with\nuseless config by using random servernames.\n","status":"published","published":"2018-03-07T20:37:26Z","modified":"2026-04-16T06:24:10.127629991Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10726-1","title":"dovecot23-2.3.16-1.6 on GA media","description":"These are all security issues fixed in the dovecot23-2.3.16-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:35.541917Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2025:14715-1","title":"dovecot24-2.4.0-1.1 on GA media","description":"These are all security issues fixed in the dovecot24-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-30T00:00:00Z","modified":"2026-02-04T03:33:59.818366Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2018:2632-1","title":"Security update for dovecot22","description":"This update for dovecot22 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-15130: Fixed a potential denial of service via TLS SNI config\n  lookups, which would slow the process down and could have led to exhaustive\n  memory allocation and/or process restarts (bsc#1082828)\n","status":"published","published":"2018-09-06T05:43:56Z","modified":"2026-02-04T04:39:03.114379Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2632-2","title":"Security update for dovecot22","description":"This update for dovecot22 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-15130: Fixed a potential denial of service via TLS SNI config\n  lookups, which would slow the process down and could have led to exhaustive\n  memory allocation and/or process restarts (bsc#1082828)\n","status":"published","published":"2018-10-18T12:50:08Z","modified":"2026-02-04T02:52:09.229899Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-3587-1","title":"dovecot vulnerabilities","description":"It was discovered that Dovecot incorrectly handled parsing certain email\naddresses. A remote attacker could use this issue to cause Dovecot to\ncrash, resulting in a denial of service, or possibly obtain sensitive\ninformation. (CVE-2017-14461)\n\nIt was discovered that Dovecot incorrectly handled TLS SNI config lookups.\nA remote attacker could possibly use this issue to cause Dovecot to crash,\nresulting in a denial of service. (CVE-2017-15130)\n","status":"published","published":"2018-03-05T12:43:51Z","modified":"2026-04-22T09:43:19.637974Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}