dovecot-pigeonhole vulnerabilities (TuxCare)
28 vulnerabilities.
dovecot-pigeonholeTuxCareAn attacker that holds a token intended for a different purpose can authenticate, because when an...7.4 Highdovecot-pigeonholeTuxCareAn unauthenticated attacker can send an IMAP ID command with a very large number of parameters...7.5 Highdovecot-pigeonholeTuxCareAn attacker that has valid credentials can use a Sieve script with the editheader extension to...9.1 Criticaldovecot-pigeonholeTuxCareNone None None No publicly available exploits are known.7.4 Highdovecot-pigeonholeTuxCareAn unauthenticated attacker can crash the ManageSieve login process by sending a small malformed...7.5 Highdovecot-pigeonholeTuxCareWhen mail_max_userip_connections is set (default 10) and reached, submission-login can crash with...4.3 Mediumdovecot-pigeonholeTuxCareAn attacker that can send mail to a user can craft a message whose headers contain a very large...7.5 Highdovecot-pigeonholeTuxCareAn attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE...4.3 Mediumdovecot-pigeonholeTuxCareAttacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl...3.1 Lowdovecot-pigeonholeTuxCareAttacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass...5.3 Mediumdovecot-pigeonholeTuxCareAttacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS...6.8 Mediumdovecot-pigeonholeTuxCareAttacker can send a specifically crafted message before authentication that causes managesieve to...7.5 Highdovecot-pigeonholeTuxCareSending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory...4.3 Mediumdovecot-pigeonholeTuxCareDoveadm credentials are verified using direct comparison which is susceptible to timing oracle...7.4 Highdovecot-pigeonholeTuxCareDovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth...6.8 Mediumdovecot-pigeonholeTuxCareWhen dovecot has been configured to use per-domain passwd files, and they are placed one path...5.3 Mediumdovecot-pigeonholeTuxCareManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be...7.5 Highdovecot-pigeonholeTuxCareDovecot has provided a script to use for attachment to text conversion. This script unsafely...4.3 Mediumdovecot-pigeonholeTuxCareVery large headers can cause resource exhaustion when parsing message. The message-parser...7.5 Highdovecot-pigeonholeTuxCareHaving a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU...5.0 Mediumdovecot-pigeonholeTuxCareAn issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two...8.8 Highdovecot-pigeonholeTuxCareThe submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp....4.8 Mediumdovecot-pigeonholeTuxCareDovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an...7.5 Highdovecot-pigeonholeTuxCareIn Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service...7.5 Highdovecot-pigeonholeTuxCareIn Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth...7.5 Highdovecot-pigeonholeTuxCareIn Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote...7.5 Highdovecot-pigeonholeTuxCareA specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out...5.9 Mediumdovecot-pigeonholeTuxCareA flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results...7.5 High