When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted POP3 server response to reasonable length/size. No publicly available exploits are known.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:51
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html - Third Party Advisory, VDB Entry | |
| References | () http://seclists.org/fulldisclosure/2023/Jun/8 - Mailing List, Third Party Advisory | |
| References | () https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json - | |
| References | () https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf - Release Notes |
12 Jan 2024, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
Information
Published : 2023-06-20 08:15
Updated : 2024-11-21 07:51
NVD link : CVE-2023-26434
Mitre link : CVE-2023-26434
CVE.ORG link : CVE-2023-26434
JSON object : View
Products Affected
open-xchange
- open-xchange_appsuite_backend
CWE