src:dovecot: multiple dovecot CVEs

Debian Bug report logs - #968302
src:dovecot: multiple dovecot CVEs

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Noah Meyerhans <noahm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: src:dovecot: multiple dovecot CVEs

Date: Wed, 12 Aug 2020 10:40:14 -0700

Package: src:dovecot
Version: 1:2.3.10.1+dfsg1-2
Severity: grave
Tags: security bullseye sid
Justification: user security hole

Multiple security issues have been identified in dovecot.  These were addressed
in stable with dovecot 1:2.3.4.1-5+deb10u3 (DSA 4745-1), but need to be tracked
in unstable and testing.

From the DSA:

CVE-2020-12100                                                                                                                                                                                                      
                                                                                                                                                                                                                    
    Receiving mail with deeply nested MIME parts leads to resource                                                                                                                                                  
    exhaustion as Dovecot attempts to parse it.                                                                                                                                                                     
                                                                                                                                                                                                                    
CVE-2020-12673                                                                                                                                                                                                      
                                                                                                                                                                                                                    
    Dovecot's NTLM implementation does not correctly check message                                                                                                                                                  
    buffer size, which leads to a crash when reading past allocation.                                                                                                                                               
                                                                                                                                                                                                                    
CVE-2020-12674                                                                                                                                                                                                      
                                                                                                                                                                                                                    
    Dovecot's RPA mechanism implementation accepts zero-length message,                                                                                                                                             
    which leads to assert-crash later on.                                                                                                                                                                           

Send a report that this bug log contains spam.