CVE-2011-1929: dovecot Improper Input Validation

CVSS: 5.0v2.0MediumModified

AliasesRHSA-2011:1187DEBIAN-CVE-2011-1929DSA-2252-1

Published 24-05-2011Last modified 06-08-2024

Vulnerability summary

CVE-2011-1929 is a medium (CVSS 5.0) Improper Input Validation vulnerability in dovecot. EPSS estimates a 3.25% chance of exploitation in the next 30 days, higher than 88.2% of scored vulnerabilities.

Overall risk

21/100

0100

Low · default modelHow is this calculated?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

3.25%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

24-05-2011
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' characters in header names, which allows remote attackers to cause a denial of service (daemon crash or mailbox corruption) via a crafted e-mail message.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

3.25%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

0.00 pp

From 3.25% on 21-09-2026

21-09-202621-10-2026

EPSS score

3.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Redhat6 products

dovecot< 0:0.99.11-10.EL4 | < 0:1.0.7-7.el5_7.1 | < 1:2.0.9-2.el6_1.1
dovecot-debuginfo< 0:0.99.11-10.EL4 | < 0:1.0.7-7.el5_7.1 | < 1:2.0.9-2.el6_1.1
dovecot-devel< 1:2.0.9-2.el6_1.1
dovecot-mysql< 1:2.0.9-2.el6_1.1
dovecot-pgsql< 1:2.0.9-2.el6_1.1

Show all 6

Debian1 product

dovecot< 1:1.2.15-7 | < 1:2.0.13-1

Dovecot1 product

dovecotEOL1.2.0 | 1.2.1 | 1.2.2 | 1.2.3 | 1.2.4 | 1.2.5 | 1.2.6 | 1.2.7 | 1.2.8 | 1.2.9 | 1.2.10 | 1.2.11 | 1.2.12 | 1.2.13 | 1.2.14 | 1.2.15 | 1.2.16 | 2.0:beta1 | 2.0.0 | 2.0.1 | 2.0.2 | 2.0.3 | 2.0.4 | 2.0.5 | 2.0.6 | 2.0.7 | 2.0.8 | 2.0.9 | 2.0.10 | 2.0.11 | 2.0.12

3 vendors · 8 products