Arch Linux alert ASA-202005-9 (dovecot)
| From: | Morten Linderud <foxboron@archlinux.org> | |
| To: | arch-security@archlinux.org | |
| Subject: | [ASA-202005-9] dovecot: multiple issues | |
| Date: | Sat, 23 May 2020 13:35:38 +0200 | |
| Message-ID: | <20200523113538.gpojillwhz2xhfzx@anathema> |
Arch Linux Security Advisory ASA-202005-9 ========================================= Severity: High Date : 2020-05-19 CVE-ID : CVE-2020-10957 CVE-2020-10958 CVE-2020-10967 Package : dovecot Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1162 Summary ======= The package dovecot before version 2.3.10.1-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.3.10.1-1. # pacman -Syu "dovecot>=2.3.10.1-1" The problems have been fixed upstream in version 2.3.10.1. Workaround ========== None. Description =========== - CVE-2020-10957 (denial of service) A NULL-pointer dereference issue has been found in Dovecot before 2.3.10.1 in the lmtp/submission component. A client can crash the server by sending a NOOP command with an invalid string parameter. This occurs particularly for a parameter that doesn't start with a double quote. This applies to all SMTP services, including submission-login, which makes it possible to crash the submission service without authentication. - CVE-2020-10958 (arbitrary code execution) A security issue has been found in Dovecot before 2.3.10.1 in the lmtp/submission component. Sending many invalid or unknown commands can cause the server to access freed memory, which can lead to a server crash. This happens when the server closes the connection with a "421 Too many invalid commands" error. The bad command limit depends on the service (lmtp or submission) and varies between 10 to 20 bad commands. - CVE-2020-10967 (denial of service) A security issue has been found in Dovecot before 2.3.10.1 in the lmtp/submission component. An authenticated attacker could send an e-mail via the submission service with empty quoted localpart which would cause the submission or lmtp component to crash. An unauthenticated attacker could send an e-mail with a bad sender or recipient address, causing the e-mail to be passed to LMTP for delivery and then crash the LMTP component unless some kind of filtering has been set up on the MTA level. Impact ====== A remote, unauthenticated attacker can crash the server, causing a denial of service. Under certain circumstances it might be possible for a remote attacker to execute arbitrary code on the affected host. References ========== https://dovecot.org/pipermail/dovecot-news/2020-May/00043... https://dovecot.org/pipermail/dovecot-news/2020-May/00043... https://github.com/dovecot/core/commit/d143ca6b7ee1196ae3... https://github.com/dovecot/core/commit/606724bd528b92347d... https://github.com/dovecot/core/commit/aedb205c79395de771... https://github.com/dovecot/core/commit/874817b169d19a4ae5... https://github.com/dovecot/core/commit/5efeccc10beccbf8d7... https://github.com/dovecot/core/commit/2b4f1e47a4ca8a192b... https://github.com/dovecot/core/commit/563bf21d8228a3c06c... https://github.com/dovecot/core/commit/18d5837748d3eafe56... https://github.com/dovecot/core/commit/063462d588eaea6f26... https://github.com/dovecot/core/commit/b34002a4ca301ed94c... https://github.com/dovecot/core/commit/92d9690da195b6ceaa... https://github.com/dovecot/core/commit/cbab48f174580bfb8d... https://security.archlinux.org/CVE-2020-10957 https://security.archlinux.org/CVE-2020-10958 https://security.archlinux.org/CVE-2020-10967