{"id":"CVE-2017-15132","aliases":["ALPINE-CVE-2017-15132","CLSA-2026-1777463410","CLSA-2026-1777463708","DEBIAN-CVE-2017-15132","DLA-1333-1","DSA-4130-1","EUVD-2017-6593","GHSA-f5gc-665w-jv83","MGASA-2018-0114","SUSE-SU-2018:0466-1","UBUNTU-CVE-2017-15132","USN-3556-1","openSUSE-SU-2024:10726-1","openSUSE-SU-2025:14715-1"],"status":"published","title":"A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results...","description":"A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0312,"percentile":0.87923,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-772"],"published":"2018-01-25T00:00:00Z","modified":"2026-10-20T13:20:28Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"dovecot","fixed_in":["2.2.34-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"dovecot","fixed_in":["2.3.1-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"dovecot","fixed_in":["1:2.0.9-23.el6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"dovecot-devel","fixed_in":["1:2.0.9-23.el6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"dovecot-mysql","fixed_in":["1:2.0.9-23.el6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"dovecot-pgsql","fixed_in":["1:2.0.9-23.el6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"dovecot-pigeonhole","fixed_in":["1:2.0.9-23.el6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"dovecot","fixed_in":["1:2.0.9-23.el6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"dovecot-devel","fixed_in":["1:2.0.9-23.el6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"dovecot-mysql","fixed_in":["1:2.0.9-23.el6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"dovecot-pgsql","fixed_in":["1:2.0.9-23.el6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"dovecot-pigeonhole","fixed_in":["1:2.0.9-23.el6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"dovecot","fixed_in":["1:2.2.34-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dovecot","fixed_in":["1:2.2.34-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dovecot","fixed_in":["1:2.2.34-1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"dovecot","fixed_in":["2.2.13-5.6.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"dovecot","fixed_in":["2.2.29.1-1.2.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"dovecot22","fixed_in":["2.2.31-19.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"dovecot22","fixed_in":["2.2.31-19.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"dovecot22","fixed_in":["2.2.31-19.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"dovecot22","fixed_in":["2.2.31-19.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"dovecot22","fixed_in":["2.2.31-19.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"dovecot22","fixed_in":["2.2.31-19.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"dovecot22","fixed_in":["2.2.31-19.5.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"dovecot","fixed_in":["1:2.2.9-1ubuntu2.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","fixed_in":["1:2.2.22-1ubuntu2.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.2.34-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-23.el6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-23.el6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-23.el6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-23.el6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-23.el6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-23.el6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-23.el6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-23.el6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-23.el6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-23.el6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.34-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.34-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.34-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.7-7+deb7u2"}]}],"versions":["1:2.1.7-7","1:2.1.7-7+deb7u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.13-12~deb8u4"}]}],"versions":["1:2.2.13-11","1:2.2.13-12~deb8u1","1:2.2.13-12~deb8u2","1:2.2.13-12~deb8u3"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.27-3+deb9u2"}]}],"versions":["1:2.2.27-3","1:2.2.27-3+deb9u1","1:2.2.27-3+deb9u2~bpo8+1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:5","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.13-5.6.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.29.1-1.2.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.5.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.9-1ubuntu2.3"}]}],"versions":["1:2.1.7-7ubuntu3","1:2.2.9-1ubuntu1","1:2.2.9-1ubuntu2","1:2.2.9-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.22-1ubuntu2.6"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2","1:2.2.22-1ubuntu2.3","1:2.2.22-1ubuntu2.4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.9-1ubuntu2.3"}]}],"versions":["1:2.1.7-7ubuntu3","1:2.2.9-1ubuntu1","1:2.2.9-1ubuntu2","1:2.2.9-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.22-1ubuntu2.6"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2","1:2.2.22-1ubuntu2.3","1:2.2.22-1ubuntu2.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.16-1.6"}]}],"bundled":22},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.1"}]}],"bundled":24}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"dovecot","product":"dovecot"},{"vendor":"the dovecot project","product":"dovecot"}],"references":[{"url":"https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1532768","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://www.debian.org/security/2018/dsa-4130","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3556-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3556-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.dovecot.org/list/dovecot-news/2018-February/000370.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15132"},{"url":"https://github.com/advisories/GHSA-f5gc-665w-jv83"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-15132","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1777463410.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1777463708.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-15132","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0114.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22468","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2018/01/25/4","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2018/01/31/1","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180466-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1075608","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15132","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-15132","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2018/01/31/1","tags":["report"]},{"url":"https://github.com/dovecot/core/commit/a9b135760aea6d1790d447d351c56b78889dac22.patch","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3556-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3556-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15132","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33515","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KZSDCZ5LA6IHY7KXVSL6ULAJVP6OFT2M/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23185","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-15132","description":"A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.","status":"published","published":"2018-01-25T20:00:00Z","modified":"2024-09-17T00:36:33.953Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:33:14.271248Z"}],"euvd":[{"id":"EUVD-2017-6593","description":"A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.","status":"published","published":"2018-01-25T20:00:00Z","modified":"2024-09-17T00:36:33Z","updated_at":"2026-11-03T00:28:57.378482Z"}],"ghsa":[{"id":"GHSA-f5gc-665w-jv83","title":"A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results...","description":"A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.","status":"published","published":"2022-05-13T01:37:33Z","modified":"2023-02-01T05:09:08Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:50:55.065879Z"}],"nvd":[{"id":"CVE-2017-15132","description":"A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.","status":"published","published":"2018-01-25T20:29:00.213Z","modified":"2026-06-17T01:07:18.403Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400","CWE-772"],"updated_at":"2026-11-02T14:04:13.257031Z"}],"osv":[{"id":"ALPINE-CVE-2017-15132","description":"A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.","status":"published","published":"2018-01-25T20:29:00.213Z","modified":"2026-07-08T04:31:09.768661637Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-15132","description":"A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.","status":"published","published":"2018-01-25T20:29:00.213Z","modified":"2026-10-20T13:20:28.211121345Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"DEBIAN-CVE-2017-15132","description":"A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.","status":"published","published":"2018-01-25T20:29:00.213Z","modified":"2026-09-01T20:03:44.412315793Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"UBUNTU-CVE-2017-15132","description":"A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.","status":"published","published":"2018-01-25T00:00:00Z","modified":"2026-04-22T11:16:57.311398Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"CLSA-2026-1777463410","title":"dovecot: Fix of CVE-2017-15132","description":"- CVE-2017-15132: fix memory leak and hash-table use-after-free in\n  auth_client_request_abort() (lib-auth). Squashed upstream commits\n  1a29ed2f96da and a9b135760aea.","status":"published","published":"2026-04-29T14:25:46Z","modified":"2026-06-01T00:33:25.956748573Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777463708","title":"dovecot: Fix of CVE-2017-15132","description":"- CVE-2017-15132: fix memory leak and hash-table use-after-free in\n  auth_client_request_abort() (lib-auth). Squashed upstream commits\n  1a29ed2f96da and a9b135760aea.","status":"published","published":"2026-05-02T01:00:50Z","modified":"2026-06-01T00:33:17.018123562Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"DLA-1333-1","title":"dovecot - security update","status":"published","published":"2018-03-31T00:00:00Z","modified":"2026-03-09T01:01:08.98492Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4130-1","title":"dovecot - security update","status":"published","published":"2018-03-02T00:00:00Z","modified":"2026-03-09T01:19:52.400799Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0114","title":"Updated dovecot packages fix security vulnerability","description":"A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL\nauthentication results in a memory leak in dovecot's auth client used by\nlogin processes. The leak has impact in high performance configuration\nwhere same login processes are reused and can cause the process to crash\ndue to memory exhaustion. (CVE-2017-15132).\n","status":"published","published":"2018-02-06T06:25:44Z","modified":"2026-04-16T06:24:39.514308426Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10726-1","title":"dovecot23-2.3.16-1.6 on GA media","description":"These are all security issues fixed in the dovecot23-2.3.16-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:35.541917Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2025:14715-1","title":"dovecot24-2.4.0-1.1 on GA media","description":"These are all security issues fixed in the dovecot24-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-30T00:00:00Z","modified":"2026-02-04T03:33:59.818366Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2018:0466-1","title":"Security update for dovecot22","description":"This update for dovecot22 fixes one issue.\n\nThis security issue was fixed:\n\n- CVE-2017-15132: An abort of SASL authentication resulted in a memory leak in\n  dovecot's auth client used by login processes. The leak has impact in high\n  performance configuration where same login processes are reused and can cause\n  the process to crash due to memory exhaustion (bsc#1075608).\n","status":"published","published":"2018-02-16T14:59:05Z","modified":"2026-02-04T04:26:16.678313Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-3556-1","title":"dovecot vulnerability","description":"It was discovered that Dovecot incorrectly handled certain authentications.\nAn attacker could possibly use this to cause a denial of service.\n","status":"published","published":"2018-02-01T18:18:21Z","modified":"2026-04-22T09:43:37.181501Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}