Detections
Analytics
Alpine: multiple dovecot packages: security update to 2.3.10-r0 (deprecated)
high Tenable Cloud Security Plugin ID 400386
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a
NULL Pointer Dereference and crash in submission-login, submission, or lmtp. (CVE-2020-10957)
- In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in
submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines
after a command. (CVE-2020-10958)
- In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by
sending mail with an empty localpart. (CVE-2020-10967)
See Also
https://git.alpinelinux.org/aports/commit/?id=0edb2384ffa13d2b8803dd4b714a30cc75c47443
https://git.alpinelinux.org/aports/commit/?id=2b1449bb52bbd408ea452e0f29312761f669c517
Plugin Details
Severity: High
ID: 400386
Version: Revision 1.23
Type: Local
Published: 8/16/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS Score Source: CVE-2020-10967
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS Score Source: CVE-2020-10957
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/21/2020
Vulnerability Publication Date: 5/18/2020