Alpine: multiple dovecot packages: security update to 2.3.10.1-r0

high Tenable Cloud Security Plugin ID 423863

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in
command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop.
(CVE-2020-7046)

- The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many
characters must be read to compute the snippet and a trailing > character exists. This causes a denial of
service in which the recipient cannot read all of their messages. (CVE-2020-7957)

- In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a
NULL Pointer Dereference and crash in submission-login, submission, or lmtp. (CVE-2020-10957)

- In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in
submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines
after a command. (CVE-2020-10958)

- In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by
sending mail with an empty localpart. (CVE-2020-10967)

Plugin Details

Severity: High

ID: 423863

Version: Revision 1.8

Type: Local

Family: Alpine Linux Local Security Checks

Published: 4/4/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2020-7046

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2/12/2020

Reference Information

CVE: CVE-2020-10957, CVE-2020-10958, CVE-2020-10967, CVE-2020-7046, CVE-2020-7957

Detections

Analytics