CVE-2020-25275

Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts.

Security Fix(es):

Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts.(CVE-2020-25275)

An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).(CVE-2020-24386)

Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts.

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

• dovecot: IMAP hibernation function allows mail access (CVE-2020-24386)

• dovecot: Denial of service via mail MIME parsing (CVE-2020-25275)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2020-12100: Resource exhaustion via deeply nested MIME parts
• CVE-2020-25275: Denial of service via mail MIME parsing

• CVE-2020-12100: Resource exhaustion via deeply nested MIME parts
• CVE-2020-25275: Denial of service via mail MIME parsing

It was discovered that Dovecot incorrectly handled certain imap hibernation commands. A remote authenticated attacker could possibly use this issue to access other users’ email (CVE-2020-24386).

Innokentii Sennovskiy discovered that Dovecot incorrectly handled MIME parsing. A remote attacker could possibly use this issue to cause Dovecot to crash, resulting in a denial of service (CVE-2020-25275).

The dovecot package has been updated to version 2.3.13, fixing these issues and other bugs. See the upstream release announcement for details.

This update for dovecot23 fixes the following issues:

Security issues fixed:

• CVE-2020-12100: Fixed a resource exhaustion caused by deeply nested MIME parts (bsc#1174920).
• CVE-2020-24386: Fixed an issue with IMAP hibernation that allowed users to access other users' emails (bsc#1180405).
• CVE-2020-25275: Fixed a crash when the 10000th MIME part was message/rfc822 (bsc#1180406).

Non-security issues fixed:

• Pigeonhole was updated to version 0.5.11.
• Dovecot was updated to version 2.3.11.3.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for dovecot23 fixes the following issues:

Security issues fixed:

• CVE-2020-12100: Fixed a resource exhaustion caused by deeply nested MIME parts (bsc#1174920).
• CVE-2020-24386: Fixed an issue with IMAP hibernation that allowed users to access other users' emails (bsc#1180405).
• CVE-2020-25275: Fixed a crash when the 10000th MIME part was message/rfc822 (bsc#1180406).

Non-security issues fixed:

• Pigeonhole was updated to version 0.5.11.
• Dovecot was updated to version 2.3.11.3.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for dovecot23 fixes the following issues:

Security issues fixed:

• CVE-2020-12100: Fixed a resource exhaustion caused by deeply nested MIME parts (bsc#1174920).
• CVE-2020-24386: Fixed an issue with IMAP hibernation that allowed users to access other users' emails (bsc#1180405).
• CVE-2020-25275: Fixed a crash when the 10000th MIME part was message/rfc822 (bsc#1180406).

Non-security issues fixed:

• Pigeonhole was updated to version 0.5.11.
• Dovecot was updated to version 2.3.11.3.

This update for dovecot23 fixes the following issues:

Security issues fixed:

• CVE-2020-12100: Fixed a resource exhaustion caused by deeply nested MIME parts (bsc#1174920).
• CVE-2020-12673: Fixed an improper implementation of NTLM that did not check the message buffer size (bsc#1174922).
• CVE-2020-12674: Fixed an improper implementation of the RPA mechanism (bsc#1174923).
• CVE-2020-24386: Fixed an issue with IMAP hibernation that allowed users to access other users' emails (bsc#1180405).
• CVE-2020-25275: Fixed a crash when the 10000th MIME part was message/rfc822 (bsc#1180406).

Non-security issues fixed:

• Pigeonhole was updated to version 0.5.11.
• Dovecot was updated to version 2.3.11.3.

This update for dovecot23 fixes the following issues:

Security issues fixed:

• CVE-2020-12100: Fixed a resource exhaustion caused by deeply nested MIME parts (bsc#1174920).
• CVE-2020-24386: Fixed an issue with IMAP hibernation that allowed users to access other users' emails (bsc#1180405).
• CVE-2020-25275: Fixed a crash when the 10000th MIME part was message/rfc822 (bsc#1180406).

Non-security issues fixed:

• Pigeonhole was updated to version 0.5.11.
• Dovecot was updated to version 2.3.11.3.

It was discovered that Dovecot incorrectly handled certain imap hibernation commands. A remote authenticated attacker could possibly use this issue to access other users' email. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2020-24386)

Innokentii Sennovskiy discovered that Dovecot incorrectly handled MIME parsing. A remote attacker could possibly use this issue to cause Dovecot to crash, resulting in a denial of service. (CVE-2020-25275)

USN-4674-1 fixed a vulnerability in Dovecot. This update provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

Innokentii Sennovskiy discovered that Dovecot incorrectly handled MIME parsing. A remote attacker could possibly use this issue to cause Dovecot to crash, resulting in a denial of service. (CVE-2020-25275)