Security update for dovecot22 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2632-1 Final 1 1 2018-09-06T05:43:56Z current 2018-09-06T05:43:56Z 2018-09-06T05:43:56Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for dovecot22 This update for dovecot22 fixes the following issues: Security issue fixed: - CVE-2017-15130: Fixed a potential denial of service via TLS SNI config lookups, which would slow the process down and could have led to exhaustive memory allocation and/or process restarts (bsc#1082828) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-7-2018-1844,SUSE-SLE-SAP-12-SP1-2018-1844,SUSE-SLE-SAP-12-SP2-2018-1844,SUSE-SLE-SDK-12-SP3-2018-1844,SUSE-SLE-SERVER-12-2018-1844,SUSE-SLE-SERVER-12-SP1-2018-1844,SUSE-SLE-SERVER-12-SP2-2018-1844,SUSE-SLE-SERVER-12-SP3-2018-1844,SUSE-Storage-4-2018-1844 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182632-1/ Link for SUSE-SU-2018:2632-1 https://lists.suse.com/pipermail/sle-security-updates/2018-September/004536.html E-Mail link for SUSE-SU-2018:2632-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1082828 SUSE Bug 1082828 https://www.suse.com/security/cve/CVE-2017-15130/ SUSE CVE CVE-2017-15130 page SUSE Enterprise Storage 4 SUSE Linux Enterprise Server 12 SP1-LTSS SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE OpenStack Cloud 7 dovecot22-2.2.31-19.11.1 dovecot22-backend-mysql-2.2.31-19.11.1 dovecot22-backend-pgsql-2.2.31-19.11.1 dovecot22-backend-sqlite-2.2.31-19.11.1 dovecot22-devel-2.2.31-19.11.1 dovecot22-2.2.31-19.11.1 as a component of SUSE Enterprise Storage 4 dovecot22-backend-mysql-2.2.31-19.11.1 as a component of SUSE Enterprise Storage 4 dovecot22-backend-pgsql-2.2.31-19.11.1 as a component of SUSE Enterprise Storage 4 dovecot22-backend-sqlite-2.2.31-19.11.1 as a component of SUSE Enterprise Storage 4 dovecot22-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS dovecot22-backend-mysql-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS dovecot22-backend-pgsql-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS dovecot22-backend-sqlite-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS dovecot22-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS dovecot22-backend-mysql-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS dovecot22-backend-pgsql-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS dovecot22-backend-sqlite-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS dovecot22-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12 SP3 dovecot22-backend-mysql-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12 SP3 dovecot22-backend-pgsql-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12 SP3 dovecot22-backend-sqlite-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12 SP3 dovecot22-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12-LTSS dovecot22-backend-mysql-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12-LTSS dovecot22-backend-pgsql-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12-LTSS dovecot22-backend-sqlite-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12-LTSS dovecot22-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 dovecot22-backend-mysql-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 dovecot22-backend-pgsql-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 dovecot22-backend-sqlite-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 dovecot22-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 dovecot22-backend-mysql-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 dovecot22-backend-pgsql-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 dovecot22-backend-sqlite-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 dovecot22-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 dovecot22-backend-mysql-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 dovecot22-backend-pgsql-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 dovecot22-backend-sqlite-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 dovecot22-devel-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 dovecot22-2.2.31-19.11.1 as a component of SUSE OpenStack Cloud 7 dovecot22-backend-mysql-2.2.31-19.11.1 as a component of SUSE OpenStack Cloud 7 dovecot22-backend-pgsql-2.2.31-19.11.1 as a component of SUSE OpenStack Cloud 7 dovecot22-backend-sqlite-2.2.31-19.11.1 as a component of SUSE OpenStack Cloud 7 A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart. CVE-2017-15130 SUSE Enterprise Storage 4:dovecot22-2.2.31-19.11.1 SUSE Enterprise Storage 4:dovecot22-backend-mysql-2.2.31-19.11.1 SUSE Enterprise Storage 4:dovecot22-backend-pgsql-2.2.31-19.11.1 SUSE Enterprise Storage 4:dovecot22-backend-sqlite-2.2.31-19.11.1 SUSE Linux Enterprise Server 12 SP1-LTSS:dovecot22-2.2.31-19.11.1 SUSE Linux Enterprise Server 12 SP1-LTSS:dovecot22-backend-mysql-2.2.31-19.11.1 SUSE Linux Enterprise Server 12 SP1-LTSS:dovecot22-backend-pgsql-2.2.31-19.11.1 SUSE Linux Enterprise Server 12 SP1-LTSS:dovecot22-backend-sqlite-2.2.31-19.11.1 SUSE Linux Enterprise Server 12 SP2-LTSS:dovecot22-2.2.31-19.11.1 SUSE Linux Enterprise Server 12 SP2-LTSS:dovecot22-backend-mysql-2.2.31-19.11.1 SUSE Linux Enterprise Server 12 SP2-LTSS:dovecot22-backend-pgsql-2.2.31-19.11.1 SUSE Linux Enterprise Server 12 SP2-LTSS:dovecot22-backend-sqlite-2.2.31-19.11.1 SUSE Linux Enterprise Server 12 SP3:dovecot22-2.2.31-19.11.1 SUSE Linux Enterprise Server 12 SP3:dovecot22-backend-mysql-2.2.31-19.11.1 SUSE Linux Enterprise Server 12 SP3:dovecot22-backend-pgsql-2.2.31-19.11.1 SUSE Linux Enterprise Server 12 SP3:dovecot22-backend-sqlite-2.2.31-19.11.1 SUSE Linux Enterprise Server 12-LTSS:dovecot22-2.2.31-19.11.1 SUSE Linux Enterprise Server 12-LTSS:dovecot22-backend-mysql-2.2.31-19.11.1 SUSE Linux Enterprise Server 12-LTSS:dovecot22-backend-pgsql-2.2.31-19.11.1 SUSE Linux Enterprise Server 12-LTSS:dovecot22-backend-sqlite-2.2.31-19.11.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:dovecot22-2.2.31-19.11.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:dovecot22-backend-mysql-2.2.31-19.11.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:dovecot22-backend-pgsql-2.2.31-19.11.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:dovecot22-backend-sqlite-2.2.31-19.11.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:dovecot22-2.2.31-19.11.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:dovecot22-backend-mysql-2.2.31-19.11.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:dovecot22-backend-pgsql-2.2.31-19.11.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:dovecot22-backend-sqlite-2.2.31-19.11.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:dovecot22-2.2.31-19.11.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:dovecot22-backend-mysql-2.2.31-19.11.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:dovecot22-backend-pgsql-2.2.31-19.11.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:dovecot22-backend-sqlite-2.2.31-19.11.1 SUSE Linux Enterprise Software Development Kit 12 SP3:dovecot22-devel-2.2.31-19.11.1 SUSE OpenStack Cloud 7:dovecot22-2.2.31-19.11.1 SUSE OpenStack Cloud 7:dovecot22-backend-mysql-2.2.31-19.11.1 SUSE OpenStack Cloud 7:dovecot22-backend-pgsql-2.2.31-19.11.1 SUSE OpenStack Cloud 7:dovecot22-backend-sqlite-2.2.31-19.11.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182632-1/ https://www.suse.com/security/cve/CVE-2017-15130.html CVE-2017-15130 https://bugzilla.suse.com/1082828 SUSE Bug 1082828