Summary
[1:2.3.8-4]
- fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1866756)
- fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1866761)
- fix CVE-2020-12674 crash due to assert in RPA implementation (#1866768)
[1:2.3.8-3]
- fix CVE-2020-10957 dovecot: malformed NOOP commands leads to DoS (#1840354)
- fix CVE-2020-10958 dovecot: command followed by sufficient number of newlines
leads to use-after-free (#1840357)
- fix CVE-2020-10967 dovecot: sending mail with empty quoted localpart
leads to DoS (#1840356)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | dovecot | 1:2.3.8-4.el8 |
| Oracle Linux · 8 | dovecot-devel | 1:2.3.8-4.el8 |
| Oracle Linux · 8 | dovecot-mysql | 1:2.3.8-4.el8 |
| Oracle Linux · 8 | dovecot-pgsql | 1:2.3.8-4.el8 |
| Oracle Linux · 8 | dovecot-pigeonhole | 1:2.3.8-4.el8 |
Vulnerabilities 2
-
Medium 5.3
In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-lo…
-
Medium 5.3
In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail w…