Resource management error in Dovecot - CVE-2020-28200

Vulnerability identifier: #VU54284

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-28200

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within regex sieve extension. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Dovecot
Arch Linux
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Server Applications
openEuler
Fedora
dovecot-debugsource
dovecot-help
dovecot-devel
dovecot-debuginfo
dovecot
dovecot23-backend-mysql
dovecot23-fts-squat-debuginfo
dovecot23-fts-squat
dovecot23-fts-solr-debuginfo
dovecot23-fts-solr
dovecot23-fts-lucene-debuginfo
dovecot23-fts-debuginfo
dovecot23
dovecot23-backend-mysql-debuginfo
dovecot23-backend-pgsql
dovecot23-backend-pgsql-debuginfo
dovecot23-backend-sqlite
dovecot23-backend-sqlite-debuginfo
dovecot23-debuginfo
dovecot23-fts-lucene
dovecot23-fts
dovecot23-devel
dovecot23-debugsource

Install updates from vendor's website.

Dovecot - update to 2.3.15
dovecot-debugsource - update to 2.3.15-1
dovecot-help - update to 2.3.15-1
dovecot-devel - update to 2.3.15-1
dovecot-debuginfo - update to 2.3.15-1
dovecot - update to 2.3.15-1
dovecot - addressed in versions 2.3.15-1.fc33, 2.3.15-1.fc34
dovecot23-backend-mysql - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-fts-squat-debuginfo - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-fts-squat - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-fts-solr-debuginfo - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-fts-solr - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-fts-lucene-debuginfo - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-fts-debuginfo - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23 - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-backend-mysql-debuginfo - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-backend-pgsql - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-backend-pgsql-debuginfo - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-backend-sqlite - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-backend-sqlite-debuginfo - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-debuginfo - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-fts-lucene - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-fts - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-devel - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-debugsource - addressed in versions 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3

• https://dovecot.org/pipermail/dovecot-news/2021-June/000460.html

• Multiple vulnerabilities in Dovecot
• Arch Linux update for pigeonhole
• SUSE update for dovecot23
• SUSE update for dovecot23
• SUSE update for dovecot23
• openEuler 20.03 LTS SP1 update for dovecot
• Fedora 33 update for dovecot
• Fedora 34 update for dovecot