{"id":"CVE-2017-2669","aliases":["DEBIAN-CVE-2017-2669","EUVD-2017-11814","GHSA-qchv-9m57-q82h","SUSE-SU-2017:1250-1","UBUNTU-CVE-2017-2669","USN-3258-1","USN-3258-2"],"status":"published","title":"Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb...","description":"Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.","severity":{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.04307,"percentile":0.91214,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2017-04-10T00:00:00Z","modified":"2026-10-20T13:21:50Z","fixes":[{"ecosystem":"Debian:12","package":"dovecot","fixed_in":["1:2.2.27-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dovecot","fixed_in":["1:2.2.27-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dovecot","fixed_in":["1:2.2.27-3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"dovecot","fixed_in":["2.2-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"dovecot22","fixed_in":["2.2.29.1-11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"dovecot22","fixed_in":["2.2.29.1-11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"dovecot22","fixed_in":["2.2.29.1-11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"dovecot","fixed_in":["2.2-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"dovecot22","fixed_in":["2.2.29.1-11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"dovecot","fixed_in":["2.2-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"dovecot22","fixed_in":["2.2.29.1-11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"dovecot","fixed_in":["2.2-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"dovecot22","fixed_in":["2.2.29.1-11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"dovecot","fixed_in":["2.2-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"dovecot22","fixed_in":["2.2.29.1-11.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","fixed_in":["1:2.2.22-1ubuntu2.3","1:2.2.22-1ubuntu2.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.27-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.27-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.27-3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.29.1-11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.29.1-11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.29.1-11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.29.1-11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.29.1-11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.29.1-11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.29.1-11.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.22-1ubuntu2.3"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.22-1ubuntu2.4"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2","1:2.2.22-1ubuntu2.3"]}],"products":[{"vendor":"[unknown]","product":"dovecot"},{"vendor":"debian","product":"debian_linux"},{"vendor":"dovecot","product":"dovecot"}],"references":[{"url":"https://dovecot.org/pipermail/dovecot-news/2017-April/000341.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2017/04/11/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2669","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/dovecot/core/commit/000030feb7a30f193197f1aab8a7b04a26b42735.patch","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3828","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/97536","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2669"},{"url":"https://github.com/advisories/GHSA-qchv-9m57-q82h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-2669","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171250-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1032248","tags":["report"]},{"url":"https://bugzilla.suse.com/854512","tags":["report"]},{"url":"https://bugzilla.suse.com/932386","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2669","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-2669","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3258-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3258-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2669","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-2669","description":"Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.","status":"published","published":"2018-06-21T13:00:00Z","modified":"2024-08-05T14:02:06.877Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:33:15.543086Z"}],"euvd":[{"id":"EUVD-2017-11814","description":"Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.","status":"published","published":"2018-06-21T13:00:00Z","modified":"2024-08-05T14:02:06Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-03T02:39:20.499267Z"}],"ghsa":[{"id":"GHSA-qchv-9m57-q82h","title":"Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb...","description":"Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.","status":"published","published":"2022-05-13T01:36:49Z","modified":"2023-02-01T05:09:03Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:50:54.417127Z"}],"nvd":[{"id":"CVE-2017-2669","description":"Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.","status":"published","published":"2018-06-21T13:29:00.317Z","modified":"2026-06-17T01:16:37.52Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:18.679411Z"}],"osv":[{"id":"CVE-2017-2669","description":"Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.","status":"published","published":"2018-06-21T13:29:00.317Z","modified":"2026-10-20T13:21:50.961466323Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-2669","description":"Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.","status":"published","published":"2018-06-21T13:29:00.317Z","modified":"2026-09-01T20:03:47.827443844Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-2669","description":"Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.","status":"withdrawn","published":"2017-04-10T00:00:00Z","modified":"2026-02-04T02:23:48.730738Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"SUSE-SU-2017:1250-1","title":"Security update for dovecot22","description":"\nThis update for dovecot22 to version 2.2.29.1 fixes the following issues:\n\nThis security issue was fixed:\n\n- CVE-2017-2669: Don't double-expand %variables in keys. If dict was used as the authentication passdb, using specially crafted %variables in the username could be used to cause DoS (bsc#1032248)\n\nAdditionally stronger SSL default ciphers are now used.\n\nThis non-security issue was fixed:\n\n- Remove all references /etc/ssl/certs/. It should not be used anymore (bsc#932386)\n\nMore changes are available in the changelog. Please make sure you read\nREADME.SUSE after installing this update.\n","status":"published","published":"2017-05-11T14:23:26Z","modified":"2026-02-04T04:16:57.803873Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3258-1","title":"dovecot vulnerability","description":"It was discovered that Dovecot incorrectly handled some usernames. An attacker\ncould possibly use this issue to cause Dovecot to hang or crash, resulting in a\ndenial of service.\n","status":"published","published":"2017-04-10T22:55:30Z","modified":"2026-04-22T09:35:26.02099Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3258-2","title":"dovecot regression","description":"USN-3258-1 intended to fix a vulnerability in Dovecot. Further investigation\nrevealed that only Dovecot versions 2.2.26 and newer were affected by the\nvulnerability. Additionally, the change introduced a regression when Dovecot\nwas configured to use the \"dict\" authentication database. This update reverts\nthe change. We apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that Dovecot incorrectly handled some usernames. An attacker\n could possibly use this issue to cause Dovecot to hang or crash, resulting in a\n denial of service.\n","status":"published","published":"2017-04-11T19:41:41Z","modified":"2026-04-22T09:34:50.797275Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}