Input validation error in Dovecot - CVE-2020-10967

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU27984

Input validation error in Dovecot - CVE-2020-10967

Published: May 18, 2020


Vulnerability identifier: #VU27984
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-10967
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input passed via email message. A remote attacker can send a specially crafted email with empty quoted localpart and crash the submission or lmtp service.

PoC:

Send mail with envelope sender or recipient as ``<""@example.org>``.

Affected software

Dovecot
Arch Linux
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Opensuse
openEuler
Fedora
dovecot (Debian package)
dovecot (Ubuntu package)
dovecot (Alpine package)
dovecot (Red Hat package)
dovecot-debuginfo
dovecot-help
dovecot-devel
dovecot-debugsource
dovecot

How to mitigate CVE-2020-10967

Install updates from vendor's website.

Dovecot - update to 2.3.10.1
dovecot (Debian package) - update to 1:2.3.4.1-5+deb10u2
dovecot (Ubuntu package) - addressed in versions 1:2.3.4.1-5ubuntu3.1, 1:2.3.7.2-1ubuntu3.1
dovecot (Alpine package) - update to 2.3.10.1-r0
dovecot (Red Hat package) - update to 2.3.8-4.el8
dovecot-debuginfo - update to 2.3.10.1-1
dovecot-help - update to 2.3.10.1-1
dovecot-devel - update to 2.3.10.1-1
dovecot-debugsource - update to 2.3.10.1-1
dovecot - update to 2.3.10.1-1
dovecot - addressed in versions 2.3.10.1-1.fc30, 2.3.10.1-1.fc31, 2.3.10.1-1.fc32, 2.3.11.3-4.fc31, 2.3.11.3-5.fc32, 2.3.11.3-5.fc33

External References

Related Security Bulletins