Red Hat Security AdvisoryRHSA-2020:3617
dovecot security update
Released 2020-09-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server (v. 7) dovecot-1:2.2.36-6.el7_8.1, dovecot-1:2.2.36-6.el7_8.1.ppc, dovecot-mysql-1:2.2.36-6.el7_8.1 +2
- Red Hat Enterprise Linux Server Optional (v. 7) dovecot-devel-1:2.2.36-6.el7_8.1
- Red Hat Enterprise Linux Workstation (v. 7) dovecot-1:2.2.36-6.el7_8.1, dovecot-mysql-1:2.2.36-6.el7_8.1, dovecot-pgsql-1:2.2.36-6.el7_8.1 +1
- Red Hat Enterprise Linux Workstation Optional (v. 7) dovecot-devel-1:2.2.36-6.el7_8.1
Fixes 3 records
Priority MEDIUM 42
In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.06187 · Published 2020-08-12 · Fixed CWE-125
Priority MEDIUM 42
In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.06187 · Published 2020-08-12 · Fixed CWE-125
Priority MEDIUM 41
In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME parts.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.05258 · Published 2020-08-12 · Partial fix CWE-674
THREATIST.IORead the docs