Vulnerability Name:

CVE-2019-10691 (CCN-159815)

Assigned:2019-04-18
Published:2019-04-18
Updated:2020-08-24
Summary:The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2019-10691

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2019:1312

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20190418 CVE-2019-10691: JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters.

Source: MLIST
Type: Mailing List, Vendor Advisory
[dovecot-news] 20190418 CVE-2019-10691: JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters.

Source: XF
Type: UNKNOWN
dovecot-cve201910691-dos(159815)

Source: FEDORA
Type: UNKNOWN
FEDORA-2019-1b61a528dd

Source: CCN
Type: oss-sec Mailing List, Thu, 18 Apr 2019 12:05:51 +0300
CVE-2019-10691: JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters

Source: GENTOO
Type: UNKNOWN
GLSA-201908-29

Source: CCN
Type: Dovecot Web site
Dovecot

Vulnerable Configuration:Configuration 1:
  • cpe:/a:dovecot:dovecot:*:*:*:*:*:*:*:* (Version < 2.3.5.2)

    • Configuration 2:
  • cpe:/o:opensuse:leap:15.0:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:dovecot:dovecot:2.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:dovecot:dovecot:2.3.5.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:201910691
    V
    		CVE-2019-10691
    2022-09-02
    oval:org.opensuse.security:def:112172
    P
    		dovecot23-2.3.16-1.6 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:4167
    P
    		Security update for webkit2gtk3 (Important)
    2021-11-03
    oval:org.opensuse.security:def:4163
    P
    		Security update for python (Moderate)
    2021-10-20
    oval:org.opensuse.security:def:4160
    P
    		Security update for libqt5-qtsvg (Moderate)
    2021-10-12
    oval:org.opensuse.security:def:105704
    P
    		dovecot23-2.3.16-1.6 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:4153
    P
    		Security update for ghostscript (Critical)
    2021-09-15
    oval:org.opensuse.security:def:51646
    P
    		Security update for the Linux Kernel (Live Patch 39 for SLE 12 SP3) (Important)
    2021-08-25
    oval:org.opensuse.security:def:51545
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)
    2021-04-28
    oval:org.opensuse.security:def:51731
    P
    		Security update for jasper (Important)
    2021-02-16
    oval:org.opensuse.security:def:51912
    P
    		Security update for ImageMagick (Important)
    2021-01-22
    oval:org.opensuse.security:def:4130
    P
    		Security update for gdk-pixbuf (Moderate)
    2021-01-21
    oval:org.opensuse.security:def:4113
    P
    		Security update for MozillaFirefox (Critical)
    2020-12-21
    oval:org.opensuse.security:def:3958
    P
    		libass-devel-0.10.2-3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4029
    P
    		libpcrecpp0-8.39-8.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4057
    P
    		libssh-devel-0.8.7-1.31 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:3946
    P
    		libXres-devel-1.0.7-3.53 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:3998
    P
    		libjpeg62-devel-62.2.0-31.14.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:3938
    P
    		libXfixes-devel-5.0.1-7.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4041
    P
    		libqt4-devel-4.8.7-8.8.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4805
    P
    		Security update for xen (Important)
    2020-12-02
    oval:org.opensuse.security:def:4826
    P
    		Security update for dovecot23 (Important)
    2020-12-02
    oval:org.opensuse.security:def:51111
    P
    		Security update for wireshark (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:53257
    P
    		Security update for dovecot23 (Important)
    2020-12-01
    oval:org.opensuse.security:def:50456
    P
    		Security update for curl (Important)
    2020-12-01
    oval:org.opensuse.security:def:50611
    P
    		Security update for elfutils (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:51837
    P
    		Security update for openexr (Low)
    2020-12-01
    oval:org.opensuse.security:def:51007
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:53188
    P
    		Security update for openssh (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:51275
    P
    		Security update for cairo (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50478
    P
    		Security update for gcc7 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:51803
    P
    		Security update for ceph (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50844
    P
    		Security update for MozillaThunderbird and mozilla-nspr (Important)
    2020-12-01
    oval:org.opensuse.security:def:50455
    P
    		Security update for libgcrypt (Moderate)
    2020-12-01
    oval:com.ubuntu.xenial:def:2019106910000000
    V
    		CVE-2019-10691 on Ubuntu 16.04 LTS (xenial) - medium.
    2019-04-24
    oval:com.ubuntu.cosmic:def:201910691000
    V
    		CVE-2019-10691 on Ubuntu 18.10 (cosmic) - medium.
    2019-04-24
    oval:com.ubuntu.disco:def:2019106910000000
    V
    		CVE-2019-10691 on Ubuntu 19.04 (disco) - medium.
    2019-04-24
    oval:com.ubuntu.bionic:def:201910691000
    V
    		CVE-2019-10691 on Ubuntu 18.04 LTS (bionic) - medium.
    2019-04-24
    oval:com.ubuntu.cosmic:def:2019106910000000
    V
    		CVE-2019-10691 on Ubuntu 18.10 (cosmic) - medium.
    2019-04-24
    oval:com.ubuntu.xenial:def:201910691000
    V
    		CVE-2019-10691 on Ubuntu 16.04 LTS (xenial) - medium.
    2019-04-24
    oval:com.ubuntu.bionic:def:2019106910000000
    V
    		CVE-2019-10691 on Ubuntu 18.04 LTS (bionic) - medium.
    2019-04-24
    oval:com.ubuntu.trusty:def:201910691000
    V
    		CVE-2019-10691 on Ubuntu 14.04 LTS (trusty) - medium.
    2019-04-24
    BACK
    dovecot dovecot *
    opensuse leap 15.0
    dovecot dovecot 2.3.0
    dovecot dovecot 2.3.5.1