Security update for dovecot22 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2632-2 Final 1 1 2018-10-18T12:50:08Z current 2018-10-18T12:50:08Z 2018-10-18T12:50:08Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for dovecot22 This update for dovecot22 fixes the following issues: Security issue fixed: - CVE-2017-15130: Fixed a potential denial of service via TLS SNI config lookups, which would slow the process down and could have led to exhaustive memory allocation and/or process restarts (bsc#1082828) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-SERVER-12-SP2-BCL-2018-1844 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182632-2/ Link for SUSE-SU-2018:2632-2 https://lists.suse.com/pipermail/sle-security-updates/2018-October/004697.html E-Mail link for SUSE-SU-2018:2632-2 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1082828 SUSE Bug 1082828 https://www.suse.com/security/cve/CVE-2017-15130/ SUSE CVE CVE-2017-15130 page SUSE Linux Enterprise Server 12 SP2-BCL dovecot22-2.2.31-19.11.1 dovecot22-backend-mysql-2.2.31-19.11.1 dovecot22-backend-pgsql-2.2.31-19.11.1 dovecot22-backend-sqlite-2.2.31-19.11.1 dovecot22-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL dovecot22-backend-mysql-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL dovecot22-backend-pgsql-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL dovecot22-backend-sqlite-2.2.31-19.11.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart. CVE-2017-15130 SUSE Linux Enterprise Server 12 SP2-BCL:dovecot22-2.2.31-19.11.1 SUSE Linux Enterprise Server 12 SP2-BCL:dovecot22-backend-mysql-2.2.31-19.11.1 SUSE Linux Enterprise Server 12 SP2-BCL:dovecot22-backend-pgsql-2.2.31-19.11.1 SUSE Linux Enterprise Server 12 SP2-BCL:dovecot22-backend-sqlite-2.2.31-19.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182632-2/ https://www.suse.com/security/cve/CVE-2017-15130.html CVE-2017-15130 https://bugzilla.suse.com/1082828 SUSE Bug 1082828