Technical impact
The vulnerability in Open‑Xchange GmbH’s OX Dovecot Pro occurs when a client sends an AUTHENTICATE command containing a literal SASL initial response, causing the ManageSieve service to crash. This crash denies legitimate users access to the service until it is restarted. The weakness is tied to improper input validation, as indicated by CWE‑20, and exhibits characteristics that may involve memory corruption per CWE‑229, and is also identified as NVD‑CWE‑noinfo. No publicly available exploits have been reported.
Affected Systems
This issue targets the ManageSieve component of OX Dovecot Pro. The advisory does not list specific affected versions, so any deployed instance of OX Dovecot Pro may be vulnerable.
Risk and Exploitability
The CVSS score of 7.5 indicates high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public exploits are known. The likely attack vector is remote, over the network via the ManageSieve service port, inferred from the nature of the service; an attacker could send a crafted AUTHENTICATE request from any reachable host, leading to repeated crashes.
Debian DLA
Debian DSA
Ubuntu USN