Dovecot Vulnerability: Truncated UTF-8 Data Handling Issue
Summary
ALPINE-CVE-2020-7046: lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop. Affects dovecot versions < 2.3.10.1-r0. Fixed in 2.3.10.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dovecot is an open-source IMAP and POP3 email server for Unix-like operating systems. It is designed to provide secure and efficient email services, supporting various authentication mechanisms and protocols. The vulnerability in question affects Dovecot versions prior to 2.3.9.3, where improper handling of truncated UTF-8 data in command parameters can lead to an infinite loop in the submission-login process, potentially causing service disruptions.
Vulnerability Detail
The vulnerability, identified as CVE-2020-7046, arises from the lib-smtp component in Dovecot's submission-login and lmtp functionalities. It mishandles truncated UTF-8 data, allowing unauthenticated users to trigger an infinite loop. This can lead to denial of service, as the server may become unresponsive due to the continuous loop. The issue is particularly concerning as it can be exploited without authentication, making it a significant risk for exposed email servers.
How To Fix
Minimum fixed version
2.3.10.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade dovecotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to the Dovecot submission-login service to trusted IP addresses, thereby minimizing the risk of exploitation until the patch is applied.
Conclusion
In summary, CVE-2020-7046 is a critical vulnerability in Dovecot that affects its handling of truncated UTF-8 data, leading to potential denial of service. It is crucial for users to update to the patched version to mitigate risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for dovecot →
FAQ
CVE-2020-7046 is a vulnerability in Dovecot that allows unauthenticated users to trigger an infinite loop due to improper handling of truncated UTF-8 data in command parameters.
If you are running Dovecot versions prior to 2.3.9.3, your installation is vulnerable. You can check your version using the command dovecot --version.
The vulnerability can lead to denial of service, causing the Dovecot server to become unresponsive and disrupt email services.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file. You can check your application against this vulnerability using the Vulert playground.
The CVSS score for CVE-2020-7046 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for dovecot.
