The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. This causes a denial of service in which the recipient cannot read all of their messages.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in
    command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop.
    (CVE-2020-7046)

  - The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many
    characters must be read to compute the snippet and a trailing > character exists. This causes a denial of
    service in which the recipient cannot read all of their messages. (CVE-2020-7957)

  - In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a
    NULL Pointer Dereference and crash in submission-login, submission, or lmtp. (CVE-2020-10957)

  - In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in
    submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines
    after a command. (CVE-2020-10958)

  - In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by
    sending mail with an empty localpart. (CVE-2020-10967)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in
    command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop.
    (CVE-2020-7046)

  - The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many
    characters must be read to compute the snippet and a trailing > character exists. This causes a denial of
    service in which the recipient cannot read all of their messages. (CVE-2020-7957)

- dovecot updated to 2.3.9.3

  - fixes CVE-2020-7046: Truncated UTF-8 can be used to DoS     submission-login and lmtp processes.

  - fixes CVE-2020-7957: Specially crafted mail can crash     snippet generation.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
423863	Alpine: multiple dovecot packages: security update to 2.3.10.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
423863	Alpine: multiple dovecot packages: security update to 2.3.10.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
423842	Alpine: multiple dovecot packages: security update to 2.3.9.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
423842	Alpine: multiple dovecot packages: security update to 2.3.9.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
133818	Fedora 31 : 1:dovecot (2020-10a58fda28)	Nessus	Fedora Local Security Checks	high
133817	Fedora 30 : 1:dovecot (2020-0e6a67af5a)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-7957

medium

Tenable Plugins

high

high

high

high

high

high