Описание
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.
A flaw was found in ManageSieve. A remote attacker can exploit this vulnerability by sending a crafted SASL (Simple Authentication and Security Layer) initial response during the AUTHENTICATE command. This can cause the ManageSieve service to crash repeatedly, leading to a Denial of Service (DoS) for other users.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | dovecot | Will not fix | ||
| Red Hat Enterprise Linux 10 | dovecot | Fixed | RHSA-2026:13498 | 04.05.2026 |
| Red Hat Enterprise Linux 10 | dovecot | Fixed | RHSA-2026:19149 | 19.05.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | dovecot | Fixed | RHSA-2026:17602 | 14.05.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | dovecot | Fixed | RHSA-2026:26564 | 17.06.2026 |
| Red Hat Enterprise Linux 8 | dovecot | Fixed | RHSA-2026:13830 | 05.05.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | dovecot | Fixed | RHSA-2026:19455 | 20.05.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | dovecot | Fixed | RHSA-2026:19455 | 20.05.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | dovecot | Fixed | RHSA-2026:19453 | 20.05.2026 |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | dovecot | Fixed | RHSA-2026:19453 | 20.05.2026 |
Показывать по
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.
ManageSieve AUTHENTICATE command crashes when using literal as SASL in ...
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version. No publicly available exploits are known.
7.5 High
CVSS3