Skip to content
Fencer Vulns
high 7.5

CVE-2017-15132 json

A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0.

published 2018-01-25 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-6593

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.1%
EPSS 3.1% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.

Patch / fix

  • dovecot Debian 14, Debian 13, Debian 12 1:2.2.34-1

debian advisories DEBIAN-CVE-2017-15132

  • dovecot Ubuntu 14.04 LTS 1:2.2.9-1ubuntu2.3
  • dovecot Ubuntu 16.04 LTS 1:2.2.22-1ubuntu2.6

ubuntu advisories UBUNTU-CVE-2017-15132

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dovecot22 SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2 +4 more 2.2.31-19.5.1

suse advisories SUSE-SU-2018:0466-1

  • dovecot24 openSUSE Tumbleweed 2.4.0-1.1
  • dovecot23 openSUSE Tumbleweed 2.3.16-1.6

opensuse advisories openSUSE-SU-2025:14715-1openSUSE-SU-2024:10726-1

  • dovecot Alpine 3.24, Alpine 3.23, Alpine 3.22 +14 more 2.3.1-r0
  • dovecot Alpine 3.7 2.2.34-r0

alpine advisories ALPINE-CVE-2017-15132

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dovecot Arch Linux 2.3.0.1-1

arch linux advisories AVG-645

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-15132 updated cvss 5.3

dovecot: Auth leaks memory if SASL authentication is aborted

  • Red Hat Enterprise Linux 6 dovecot, dovecot-mysql, dovecot-pgsql, dovecot-pigeonhole Red Hat Enterprise Linux 7 dovecot, dovecot-mysql, dovecot-pgsql, dovecot-pigeonhole
    affected: workaround, no fix available “This issue can be mitigated on vulnerable systems by limiting the login process to a single request per process, which is also the default value.”
  • Red Hat Enterprise Linux 5 dovecot Red Hat Enterprise Linux 8 dovecot, dovecot-mysql, dovecot-pgsql, dovecot-pigeonhole
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.12% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • The Dovecot Project dovecot

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-772 Missing Release of Resource after Effective Lifetime

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.