Djvirus

**Name of the Vulnerable Software and Affected Versions** dovecot versions prior to 2.4.5-1.1 **Description** An attacker can craft a message header that causes the IMAP THREAD command to consume CPU resources disproportionate to the message size. When a mail client executes the THREAD command on the affected mailbox, it can lead to performance degradation or a denial of service for the IMAP service. **Recommendations** Update to version 2.4.5-1.1. Monitor the system for abnormal CPU usage, terminate the offending process, and remove the malicious message from the affected mailbox.

**Name of the Vulnerable Software and Affected Versions** dovecot versions prior to 2.4.5-1.1 **Description** An attacker can send a crafted email with message header values designed to collide in an internal hash table. This causes the IMAP THREAD command to consume CPU resources disproportionate to the message size. When a mail client executes the THREAD command on the affected mailbox, it can lead to performance degradation or a denial of service for the IMAP service. **Recommendations** Update to version 2.4.5-1.1. Monitor the system for abnormal CPU usage, terminate the offending process, and remove the malicious message from the affected mailbox.

**Name of the Vulnerable Software and Affected Versions** dovecot versions prior to 2.4.5-1.1 **Description** An attacker with valid credentials can send an invalid IMAP URLFETCH command, causing the system to include uninitialized memory in the error response returned to the client. This can lead to the disclosure of process memory contents, which may contain sensitive data. **Recommendations** Update to version 2.4.5-1.1. Disable the IMAP URLAUTH functionality.

**Name of the Vulnerable Software and Affected Versions** Dovecot versions prior to 2.4.3-1.1 **Description** A mail message with a large number of RFC 2231 MIME parameters can cause excessive CPU usage in LMTP. A specially crafted message can lead to significant CPU time consumption during mail delivery. No publicly available exploits are known. **Recommendations** Upgrade to version 2.4.3-1.1 or later. Limit RFC 2231 MIME parameters in mail messages using MTA capabilities.