VulnerabilityModified
CVE-2019-11500
This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.
CRITICAL 9.8EPSS 62.6%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 62.6%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 62.58% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- dovecot/dovecot · dovecot/pigeonhole · debian/debian linux · fedoraproject/fedora
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00026.html
- http://www.openwall.com/lists/oss-security/2019/08/28/3Exploit, Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2822
- https://access.redhat.com/errata/RHSA-2019:2836
- https://access.redhat.com/errata/RHSA-2019:2885
- https://dovecot.org/pipermail/dovecot-news/2019-August/000417.htmlPatch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/08/msg00035.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GYTZLLDNIFWT7D7JSB25ERJNMOR4CQ3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVHY3MU2OK2EWZJFGNDSAOMD42L7DFPX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSJVVVRAE3SITC2ZLGCPMFDN3WVYZBWF/
- https://security.gentoo.org/glsa/201908-29Third Party Advisory
- https://www.dovecot.org/security.htmlVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00026.html
- http://www.openwall.com/lists/oss-security/2019/08/28/3Exploit, Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2822
- https://access.redhat.com/errata/RHSA-2019:2836
- https://access.redhat.com/errata/RHSA-2019:2885
- https://dovecot.org/pipermail/dovecot-news/2019-August/000417.htmlPatch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/08/msg00035.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GYTZLLDNIFWT7D7JSB25ERJNMOR4CQ3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVHY3MU2OK2EWZJFGNDSAOMD42L7DFPX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSJVVVRAE3SITC2ZLGCPMFDN3WVYZBWF/
- https://security.gentoo.org/glsa/201908-29Third Party Advisory
- https://www.dovecot.org/security.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.