CVE-2015-3420

NameCVE-2015-3420
DescriptionThe ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) via vectors related to handshake failures.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)
Debian Bugs783649

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
dovecot (PTS)wheezy1:2.1.7-7+deb7u1fixed
wheezy (security)1:2.1.7-7+deb7u2fixed
jessie1:2.2.13-12~deb8u3fixed
jessie (security)1:2.2.13-12~deb8u4fixed
stretch (security), stretch1:2.2.27-3+deb9u2fixed
buster, sid1:2.2.35-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
dovecotsource(unstable)1:2.2.13-12medium783649
dovecotsourcejessie1:2.2.13-12~deb8u1medium
dovecotsourcesqueeze(not affected)
dovecotsourcewheezy(not affected)

Notes

[wheezy] - dovecot <not-affected> (Problematic patch introducing the issue not applied)
[squeeze] - dovecot <not-affected> (Vulnerable code not present & not reproducible)
http://www.openwall.com/lists/oss-security/2015/04/26/3
Patch: http://web.archive.org/web/20150907231530/http://hg.dovecot.org/dovecot-2.2/rev/86f535375750
Segfault reproducible if using openssl/1.0.2a-1 from sid.
http://dovecot.org/pipermail/dovecot/2015-April/100579.html
It is openssl crashing but because dovecot ignores an erlier
returned error from dovecot, related to openssl bug:
https://rt.openssl.org/Ticket/Display.html?id=3818&user=guest&pass=guest
Possibly introduced due to http://web.archive.org/web/20150121182933/http://hg.dovecot.org:80/dovecot-2.2/rev/09d3c9c6f0ad

Search for package or bug name: Reporting problems