Summary
[1:2.2.36-8]
- update release number
[1:2.2.36-7.1]
- fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1866752)
- fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1866757)
- fix CVE-2020-12674 crash due to assert in RPA implementation (#1866764)
[1:2.2.36-7]
- generated key was too small (#1086365)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | dovecot | 1:2.2.36-8.el7 |
| Oracle Linux · 7 | dovecot-devel | 1:2.2.36-8.el7 |
| Oracle Linux · 7 | dovecot-mysql | 1:2.2.36-8.el7 |
| Oracle Linux · 7 | dovecot-pgsql | 1:2.2.36-8.el7 |
| Oracle Linux · 7 | dovecot-pigeonhole | 1:2.2.36-8.el7 |
Vulnerabilities 4
-
High 7.5
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageS…
-
High 7.5
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount…
-
High 7.4
Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can …
-
Medium 4.3
Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands w…