Summary
It was discovered that Dovecot incorrectly handled deeply nested MIME
parts. A remote attacker could possibly use this issue to cause Dovecot to
consume resources, resulting in a denial of service. (CVE-2020-12100)
It was discovered that Dovecot incorrectly handled memory when using NTLM.
A remote attacker could possibly use this issue to cause Dovecot to crash,
resulting in a denial of service. (CVE-2020-12673)
It was discovered that the Dovecot RPA mechanism incorrectly handled
zero-length messages. A remote attacker could possibly use this issue to
cause Dovecot to crash, resulting in a denial of service. (CVE-2020-12674)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | dovecot | 1:2.2.22-1ubuntu2.13 |
| Ubuntu · 18.04 LTS 18.04:LTS | dovecot | 1:2.2.33.2-1ubuntu4.6 |
| Ubuntu · 20.04 LTS 20.04:LTS | dovecot | 1:2.3.7.2-1ubuntu3.2 |
Vulnerabilities 3
-
Unscored —
In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a deni…
-
Unscored —
In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of…
-
Unscored —
In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of z…