CVE-2019-10691

Vulnerability

The JSON encoder in Dovecot versions 2.3.0 through 2.3.5.1 incorrectly asserts when processing invalid UTF-8 characters, leading to a crash. This affects the authentication service when auth policy is enabled [1][2]. It can also be triggered during OX push notification delivery if an email contains invalid UTF-8 in the From or Subject headers [2]. In version 2.2.x, malformed UTF-8 sequences are passed through without issue [2].

Exploitation

An unauthenticated remote attacker can repeatedly crash the Dovecot authentication process by attempting to authenticate with a username containing an invalid UTF-8 sequence, provided auth policy is enabled [2]. Additionally, if the OX push notification driver is enabled, an attacker can send an email with an invalid UTF-8 sequence in the From or Subject header to trigger a crash [2]. No special privileges or user interaction beyond sending a crafted request or email are required.

Impact

Successful exploitation causes a denial of service (DoS) by repeatedly crashing the authentication service, preventing legitimate users from authenticating [1][2]. The CVSS score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) [2]. No information disclosure, privilege escalation, or remote code execution is reported.

Mitigation

The vulnerability is fixed in Dovecot version 2.3.5.2, released 2019-04-11 [1][2]. Users should upgrade to that version or later. If upgrading is not immediately possible, disabling auth policy or OX push notification driver may reduce exposure, but the vendor recommends upgrading [2]. The Gentoo advisory (GLSA 201908-29) also recommends upgrading to >=net-mail/dovecot-2.3.7.2 [4].