Moderate: dovecot security update
Summary
ALSA-2020:4763: Moderate: dovecot security update. Affects dovecot versions < 1:2.3.8-4.el8. Fixed in 1:2.3.8-4.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dovecot is an IMAP server for Linux and other UNIX-like systems, designed with security as a primary focus. It includes a small POP3 server and supports email in either the maildir or mbox format. The package also provides SQL drivers and authentication plugins as subpackages.
Vulnerability Detail
The vulnerability identified as CVE-2020-10958 in dovecot allows an attacker to trigger a use-after-free condition by executing a command followed by a sufficient number of newlines. This can lead to a potential security breach. Another vulnerability, CVE-2020-10967, enables a denial-of-service (DoS) attack by sending an email with an empty quoted localpart. These vulnerabilities can have varying impacts on the system's security and stability.
How To Fix
Minimum fixed version
1:2.3.8-4.el8
This is the first release that contains the fix.
sudo dnf update dovecotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Dovecot users are advised to update their installations to version 1:2.3.8-4.el8 or later to mitigate the identified vulnerabilities. Regularly updating software is crucial for maintaining a secure and stable system. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dovecot →
FAQ
Dovecot is an IMAP server primarily used on Linux and UNIX-like systems. It provides secure email services and supports various email formats.
A use-after-free vulnerability occurs when a program continues to use a memory area after it has been freed. This can lead to unpredictable behavior and potential security risks.
A denial-of-service attack aims to disrupt the normal functioning of a system or network, making it inaccessible to legitimate users. In the case of CVE-2020-10967, it can be triggered by sending an email with an empty quoted localpart.
The use-after-free vulnerability (CVE-2020-10958) can potentially allow an attacker to execute arbitrary code or cause a crash, leading to a security breach. The DoS vulnerability (CVE-2020-10967) can result in the unavailability of email services, affecting system stability and user experience.
To update the dovecot package, you can use the package manager specific to your Linux distribution. For AlmaLinux 8, you can run the following command:
sudo yum update dovecot
References
Related vulnerabilities
Recent vulnerabilities recorded for dovecot.
