Denial of Service Vulnerability in Dovecot IMAP and LMTP Components
Summary
ALPINE-CVE-2020-7957: The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. Affects dovecot versions < 2.3.10.1-r0. Fixed in 2.3.10.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dovecot is an open-source IMAP and POP3 server for Unix-like operating systems, designed to provide secure and efficient email retrieval. It is widely used for its performance, flexibility, and ease of integration with various email clients. The vulnerability in question affects the snippet generation feature of Dovecot, which is responsible for creating message previews. This issue can lead to service disruptions for users attempting to read their emails.
Vulnerability Detail
The vulnerability, identified as CVE-2020-7957, arises from improper handling of snippet generation in Dovecot versions prior to 2.3.9.3. When many characters are required to compute a snippet and a trailing '>' character is present, it can cause a denial of service. This means that recipients may be unable to read their messages, leading to significant disruptions in email communication. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.3.10.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade dovecotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the number of characters processed for snippet generation or disable snippet generation entirely until the update can be applied. This can be done by modifying the Dovecot configuration file, typically located at /etc/dovecot/dovecot.conf, and setting the snippet generation option to 'no'.
Conclusion
The vulnerability CVE-2020-7957 in Dovecot poses a risk of denial of service due to improper snippet generation. It is crucial for users to update their Dovecot installations to version 2.3.9.3 or later to mitigate this risk. Temporary workarounds are available, but applying the patch is the recommended solution.
See every vulnerability recorded for dovecot →
FAQ
CVE-2020-7957 is a vulnerability in Dovecot that affects the IMAP and LMTP components, leading to a denial of service due to improper snippet generation.
If you are running a version of Dovecot prior to 2.3.9.3, your installation is vulnerable to CVE-2020-7957.
The vulnerability can prevent users from reading their emails, causing significant disruptions in communication.
Yes, tools like Vulert can monitor your application for open-source vulnerabilities in real-time using a manifest file.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring an account.
References
Related vulnerabilities
Recent vulnerabilities recorded for dovecot.
