CVE-2017-15130

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Mar 2, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-151317.8It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh befor CVE-2017-151327.5A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client us CVE-2017-151337.5A denial of service flaw was found in miekg-dns before 1.0.4. A remote attacker could use carefully timed TCP packets to block the DNS serve CVE-2017-151347.5A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled CVE-2017-151358.1It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly CVE-2017-151362.7When registering and activating a new system with Red Hat Satellite 6 if the new systems hostname is then reset to the hostname of a previou CVE-2017-151375.3The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This coul CVE-2017-151385.0The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidentia CVE-2017-151397.5A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume CVE-2017-15154.3IBM Doors Web Access 9.5 and 9.6 could allow an authenticated user to obtain sensitive information from HTTP internal server error responses CVE-2017-15165.4IBM Doors Web Access 9.5 and 9.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit CVE-2017-151855.0plugins/ogg.c in Libmp3splt 0.9.2 calls the libvorbis vorbis_block_clear function with uninitialized data upon detection of invalid input, w