dovecot-devel vulnerabilities (TuxCare)
28 vulnerabilities.
dovecot-develTuxCareAn attacker that holds a token intended for a different purpose can authenticate, because when an...7.4 Highdovecot-develTuxCareAn unauthenticated attacker can send an IMAP ID command with a very large number of parameters...7.5 Highdovecot-develTuxCareAn attacker that has valid credentials can use a Sieve script with the editheader extension to...9.1 Criticaldovecot-develTuxCareNone None None No publicly available exploits are known.7.4 Highdovecot-develTuxCareAn unauthenticated attacker can crash the ManageSieve login process by sending a small malformed...7.5 Highdovecot-develTuxCareWhen mail_max_userip_connections is set (default 10) and reached, submission-login can crash with...4.3 Mediumdovecot-develTuxCareAn attacker that can send mail to a user can craft a message whose headers contain a very large...7.5 Highdovecot-develTuxCareAn attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE...4.3 Mediumdovecot-develTuxCareAttacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl...3.1 Lowdovecot-develTuxCareAttacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass...5.3 Mediumdovecot-develTuxCareAttacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS...6.8 Mediumdovecot-develTuxCareAttacker can send a specifically crafted message before authentication that causes managesieve to...7.5 Highdovecot-develTuxCareSending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory...4.3 Mediumdovecot-develTuxCareDoveadm credentials are verified using direct comparison which is susceptible to timing oracle...7.4 Highdovecot-develTuxCareDovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth...6.8 Mediumdovecot-develTuxCareWhen dovecot has been configured to use per-domain passwd files, and they are placed one path...5.3 Mediumdovecot-develTuxCareManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be...7.5 Highdovecot-develTuxCareDovecot has provided a script to use for attachment to text conversion. This script unsafely...4.3 Mediumdovecot-develTuxCareVery large headers can cause resource exhaustion when parsing message. The message-parser...7.5 Highdovecot-develTuxCareHaving a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU...5.0 Mediumdovecot-develTuxCareAn issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two...8.8 Highdovecot-develTuxCareThe submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp....4.8 Mediumdovecot-develTuxCareDovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an...7.5 Highdovecot-develTuxCareIn Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service...7.5 Highdovecot-develTuxCareIn Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth...7.5 Highdovecot-develTuxCareIn Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote...7.5 Highdovecot-develTuxCareA specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out...5.9 Mediumdovecot-develTuxCareA flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results...7.5 High