SUSE update for dovecot23

Published: 2021-08-31

Risk	Medium
Patch available	YES
Number of vulnerabilities	5
CVE-ID	CVE-2020-12100 CVE-2020-24386 CVE-2020-28200 CVE-2021-29157 CVE-2021-33515
CWE-ID	CWE-835 CWE-200 CWE-399 CWE-22 CWE-74
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	SUSE Manager Proxy Operating systems & Components / Operating system SUSE Manager Retail Branch Server Operating systems & Components / Operating system SUSE Manager Server Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Enterprise Storage Operating systems & Components / Operating system SUSE CaaS Platform Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system dovecot23-fts-squat-debuginfo Operating systems & Components / Operating system package or component dovecot23-fts-squat Operating systems & Components / Operating system package or component dovecot23-fts-solr-debuginfo Operating systems & Components / Operating system package or component dovecot23-fts-solr Operating systems & Components / Operating system package or component dovecot23-fts-lucene-debuginfo Operating systems & Components / Operating system package or component dovecot23-fts-lucene Operating systems & Components / Operating system package or component dovecot23-fts-debuginfo Operating systems & Components / Operating system package or component dovecot23-fts Operating systems & Components / Operating system package or component dovecot23-devel Operating systems & Components / Operating system package or component dovecot23-debugsource Operating systems & Components / Operating system package or component dovecot23-debuginfo Operating systems & Components / Operating system package or component dovecot23-backend-sqlite-debuginfo Operating systems & Components / Operating system package or component dovecot23-backend-sqlite Operating systems & Components / Operating system package or component dovecot23-backend-pgsql-debuginfo Operating systems & Components / Operating system package or component dovecot23-backend-pgsql Operating systems & Components / Operating system package or component dovecot23-backend-mysql-debuginfo Operating systems & Components / Operating system package or component dovecot23-backend-mysql Operating systems & Components / Operating system package or component dovecot23 Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Infinite loop

EUVDB-ID: #VU45671

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-12100

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in submission, lmtp, and lda when processing e-mail message with deeply nested MIME parts. A remote attacker can send a specially crafted email to consume all available system resources and cause denial of service conditions.

Mitigation

Update the affected package dovecot23 to the latest version.

Vulnerable software versions

SUSE Manager Proxy: 4.0

SUSE Manager Retail Branch Server: 4.0

SUSE Manager Server: 4.0

SUSE Linux Enterprise Server for SAP: 15-SP1

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP1-LTSS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS

dovecot23-fts-squat-debuginfo: before 2.3.15-27.3

dovecot23-fts-squat: before 2.3.15-27.3

dovecot23-fts-solr-debuginfo: before 2.3.15-27.3

dovecot23-fts-solr: before 2.3.15-27.3

dovecot23-fts-lucene-debuginfo: before 2.3.15-27.3

dovecot23-fts-lucene: before 2.3.15-27.3

dovecot23-fts-debuginfo: before 2.3.15-27.3

dovecot23-fts: before 2.3.15-27.3

dovecot23-devel: before 2.3.15-27.3

dovecot23-debugsource: before 2.3.15-27.3

dovecot23-debuginfo: before 2.3.15-27.3

dovecot23-backend-sqlite-debuginfo: before 2.3.15-27.3

dovecot23-backend-sqlite: before 2.3.15-27.3

dovecot23-backend-pgsql-debuginfo: before 2.3.15-27.3

dovecot23-backend-pgsql: before 2.3.15-27.3

dovecot23-backend-mysql-debuginfo: before 2.3.15-27.3

dovecot23-backend-mysql: before 2.3.15-27.3

dovecot23: before 2.3.15-27.3

External links

http://www.suse.com/support/update/announcement/2021/suse-su-20212891-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU49237

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-24386

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to an error, related to IMAP hibernation. A remote user can run a specially crafted command to discover system directory structure and access emails of other users.

Mitigation

Update the affected package dovecot23 to the latest version.

Vulnerable software versions

SUSE Manager Proxy: 4.0

SUSE Manager Retail Branch Server: 4.0

SUSE Manager Server: 4.0

SUSE Linux Enterprise Server for SAP: 15-SP1

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP1-LTSS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS

dovecot23-fts-squat-debuginfo: before 2.3.15-27.3

dovecot23-fts-squat: before 2.3.15-27.3

dovecot23-fts-solr-debuginfo: before 2.3.15-27.3

dovecot23-fts-solr: before 2.3.15-27.3

dovecot23-fts-lucene-debuginfo: before 2.3.15-27.3

dovecot23-fts-lucene: before 2.3.15-27.3

dovecot23-fts-debuginfo: before 2.3.15-27.3

dovecot23-fts: before 2.3.15-27.3

dovecot23-devel: before 2.3.15-27.3

dovecot23-debugsource: before 2.3.15-27.3

dovecot23-debuginfo: before 2.3.15-27.3

dovecot23-backend-sqlite-debuginfo: before 2.3.15-27.3

dovecot23-backend-sqlite: before 2.3.15-27.3

dovecot23-backend-pgsql-debuginfo: before 2.3.15-27.3

dovecot23-backend-pgsql: before 2.3.15-27.3

dovecot23-backend-mysql-debuginfo: before 2.3.15-27.3

dovecot23-backend-mysql: before 2.3.15-27.3

dovecot23: before 2.3.15-27.3

External links

http://www.suse.com/support/update/announcement/2021/suse-su-20212891-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource management error

EUVDB-ID: #VU54284

Risk: Medium

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-28200

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within regex sieve extension. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package dovecot23 to the latest version.

Vulnerable software versions

SUSE Manager Proxy: 4.0

SUSE Manager Retail Branch Server: 4.0

SUSE Manager Server: 4.0

SUSE Linux Enterprise Server for SAP: 15-SP1

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP1-LTSS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS

dovecot23-fts-squat-debuginfo: before 2.3.15-27.3

dovecot23-fts-squat: before 2.3.15-27.3

dovecot23-fts-solr-debuginfo: before 2.3.15-27.3

dovecot23-fts-solr: before 2.3.15-27.3

dovecot23-fts-lucene-debuginfo: before 2.3.15-27.3

dovecot23-fts-lucene: before 2.3.15-27.3

dovecot23-fts-debuginfo: before 2.3.15-27.3

dovecot23-fts: before 2.3.15-27.3

dovecot23-devel: before 2.3.15-27.3

dovecot23-debugsource: before 2.3.15-27.3

dovecot23-debuginfo: before 2.3.15-27.3

dovecot23-backend-sqlite-debuginfo: before 2.3.15-27.3

dovecot23-backend-sqlite: before 2.3.15-27.3

dovecot23-backend-pgsql-debuginfo: before 2.3.15-27.3

dovecot23-backend-pgsql: before 2.3.15-27.3

dovecot23-backend-mysql-debuginfo: before 2.3.15-27.3

dovecot23-backend-mysql: before 2.3.15-27.3

dovecot23: before 2.3.15-27.3

External links

http://www.suse.com/support/update/announcement/2021/suse-su-20212891-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Path traversal

EUVDB-ID: #VU54285

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-29157

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a local user to perform directory traversal attacks.

The vulnerability exists due to validation of kid and azp fields in JWT tokens. A local user to ability to control a JWT token location can login as any MTA user and access their emails.

Mitigation

Update the affected package dovecot23 to the latest version.

Vulnerable software versions

SUSE Manager Proxy: 4.0

SUSE Manager Retail Branch Server: 4.0

SUSE Manager Server: 4.0

SUSE Linux Enterprise Server for SAP: 15-SP1

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP1-LTSS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS

dovecot23-fts-squat-debuginfo: before 2.3.15-27.3

dovecot23-fts-squat: before 2.3.15-27.3

dovecot23-fts-solr-debuginfo: before 2.3.15-27.3

dovecot23-fts-solr: before 2.3.15-27.3

dovecot23-fts-lucene-debuginfo: before 2.3.15-27.3

dovecot23-fts-lucene: before 2.3.15-27.3

dovecot23-fts-debuginfo: before 2.3.15-27.3

dovecot23-fts: before 2.3.15-27.3

dovecot23-devel: before 2.3.15-27.3

dovecot23-debugsource: before 2.3.15-27.3

dovecot23-debuginfo: before 2.3.15-27.3

dovecot23-backend-sqlite-debuginfo: before 2.3.15-27.3

dovecot23-backend-sqlite: before 2.3.15-27.3

dovecot23-backend-pgsql-debuginfo: before 2.3.15-27.3

dovecot23-backend-pgsql: before 2.3.15-27.3

dovecot23-backend-mysql-debuginfo: before 2.3.15-27.3

dovecot23-backend-mysql: before 2.3.15-27.3

dovecot23: before 2.3.15-27.3

External links

http://www.suse.com/support/update/announcement/2021/suse-su-20212891-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Code injection

EUVDB-ID: #VU54286

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33515

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists in the way STARTTLS command in processed by the SMTP server. the commands sent during the session before the STARTTLS command are queued and executed later, after the STARTTLS finished with the client. As a result, a remote attacker can perform a MitM attack and gain access to victim's emails.

Mitigation

Update the affected package dovecot23 to the latest version.

Vulnerable software versions

SUSE Manager Proxy: 4.0

SUSE Manager Retail Branch Server: 4.0

SUSE Manager Server: 4.0

SUSE Linux Enterprise Server for SAP: 15-SP1

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP1-LTSS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS

dovecot23-fts-squat-debuginfo: before 2.3.15-27.3

dovecot23-fts-squat: before 2.3.15-27.3

dovecot23-fts-solr-debuginfo: before 2.3.15-27.3

dovecot23-fts-solr: before 2.3.15-27.3

dovecot23-fts-lucene-debuginfo: before 2.3.15-27.3

dovecot23-fts-lucene: before 2.3.15-27.3

dovecot23-fts-debuginfo: before 2.3.15-27.3

dovecot23-fts: before 2.3.15-27.3

dovecot23-devel: before 2.3.15-27.3

dovecot23-debugsource: before 2.3.15-27.3

dovecot23-debuginfo: before 2.3.15-27.3

dovecot23-backend-sqlite-debuginfo: before 2.3.15-27.3

dovecot23-backend-sqlite: before 2.3.15-27.3

dovecot23-backend-pgsql-debuginfo: before 2.3.15-27.3

dovecot23-backend-pgsql: before 2.3.15-27.3

dovecot23-backend-mysql-debuginfo: before 2.3.15-27.3

dovecot23-backend-mysql: before 2.3.15-27.3

dovecot23: before 2.3.15-27.3

External links

http://www.suse.com/support/update/announcement/2021/suse-su-20212891-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.