Red Hat Security AdvisoryRHSA-2020:3713
dovecot security update
Released 2020-09-10 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder (v. 8) dovecot-1:2.3.8-2.el8_2.2, dovecot-devel-1:2.3.8-2.el8_2.2
- Red Hat Enterprise Linux AppStream (v. 8) dovecot-1:2.3.8-2.el8_2.2, dovecot-mysql-1:2.3.8-2.el8_2.2, dovecot-pgsql-1:2.3.8-2.el8_2.2 +1
Fixes 3 records
Priority MEDIUM 42
In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.06187 · Published 2020-08-12 · Fixed CWE-125
Priority MEDIUM 42
In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.06187 · Published 2020-08-12 · Fixed CWE-125
Priority MEDIUM 41
In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME parts.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.05258 · Published 2020-08-12 · Partial fix CWE-674
THREATIST.IORead the docs