Open-Xchange OX Dovecot Uncontrolled Resource Consumption Vulnerability Allowing CPU Time Limit Bypass

A vulnerability exists in Open-Xchange Dovecot Pro and Community Edition versions 2.3.0, 3.0.5, 3.1.0, 3.1.4, and 3.1.5. This vulnerability allows an attacker to upload a malicious Sieve script via the ManageSieve service or locally, bypassing the configured CPU time limits for Sieve scripts. The exploitation can lead to a degradation of server performance, with the potential to exceed the normal CPU time limits by up to 130 times. No publicly available exploits are known.

Impact

Exploitation of this vulnerability can cause significant server performance degradation by allowing Sieve scripts to consume excessive CPU resources, bypassing normal time limits and potentially leading to a denial-of-service condition.

Remediation

Users are advised to update to the fixed version or, alternatively, prevent direct access to Sieve scripts via ManageSieve or local access.