ALINUX2-SA-2020%3A0114

ALINUX2-SA-2020%3A0114 PUBLISHED CVSS 7.5 HIGH

Package updates are available for Alibaba Cloud Linux 2.1903 that fix the following vulnerabilities: CVE-2020-12100: In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME parts. CVE-2020-12673: In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read. CVE-2020-12674: In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled.

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
Alibaba Cloud	dovecot

Timeline

Sep 4, 2020 CVE Published
Sep 4, 2020 CVE Updated

References

ALINUX2-SA-2020:0114: dovecot security update (Important) advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12673 advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12674 advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12100 advisory

Open in Interactive Console →