Input validation error in Dovecot - CVE-2020-7957
Published: February 13, 2020
Vulnerability identifier: #VU25340
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-7957
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input within the IMAP and LMTP components when many characters must be read while computing the snippet and a trailing ">" character is present. As a result the recipient cannot read all messages in the mailbox.
Affected software
Dovecot
Arch Linux
Fedora
dovecot (Alpine package)
dovecot
Arch Linux
Fedora
dovecot (Alpine package)
dovecot
How to mitigate CVE-2020-7957
Install updates from vendor's website.
Dovecot - update to 2.3.9.3
dovecot (Alpine package) - addressed in versions 2.3.9.3-r0, 2.3.10.1-r0
dovecot - addressed in versions 2.3.9.3-1.fc30, 2.3.9.3-1.fc31
dovecot (Alpine package) - addressed in versions 2.3.9.3-r0, 2.3.10.1-r0
dovecot - addressed in versions 2.3.9.3-1.fc30, 2.3.9.3-1.fc31