ASA-202005-9 log original external raw

Arch Linux Security Advisory ASA-202005-9 ========================================= Severity: High Date : 2020-05-19 CVE-ID : CVE-2020-10957 CVE-2020-10958 CVE-2020-10967 Package : dovecot Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1162 Summary ======= The package dovecot before version 2.3.10.1-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.3.10.1-1. # pacman -Syu "dovecot>=2.3.10.1-1" The problems have been fixed upstream in version 2.3.10.1. Workaround ========== None. Description =========== - CVE-2020-10957 (denial of service) A NULL-pointer dereference issue has been found in Dovecot before 2.3.10.1 in the lmtp/submission component. A client can crash the server by sending a NOOP command with an invalid string parameter. This occurs particularly for a parameter that doesn't start with a double quote. This applies to all SMTP services, including submission-login, which makes it possible to crash the submission service without authentication. - CVE-2020-10958 (arbitrary code execution) A security issue has been found in Dovecot before 2.3.10.1 in the lmtp/submission component. Sending many invalid or unknown commands can cause the server to access freed memory, which can lead to a server crash. This happens when the server closes the connection with a "421 Too many invalid commands" error. The bad command limit depends on the service (lmtp or submission) and varies between 10 to 20 bad commands. - CVE-2020-10967 (denial of service) A security issue has been found in Dovecot before 2.3.10.1 in the lmtp/submission component. An authenticated attacker could send an e-mail via the submission service with empty quoted localpart which would cause the submission or lmtp component to crash. An unauthenticated attacker could send an e-mail with a bad sender or recipient address, causing the e-mail to be passed to LMTP for delivery and then crash the LMTP component unless some kind of filtering has been set up on the MTA level. Impact ====== A remote, unauthenticated attacker can crash the server, causing a denial of service. Under certain circumstances it might be possible for a remote attacker to execute arbitrary code on the affected host. References ========== https://dovecot.org/pipermail/dovecot-news/2020-May/000437.html https://dovecot.org/pipermail/dovecot-news/2020-May/000438.html https://github.com/dovecot/core/commit/d143ca6b7ee1196ae3eafffbf6dee71a95a5e0b8 https://github.com/dovecot/core/commit/606724bd528b92347dce580d3ab48fc1e3c2f4d7 https://github.com/dovecot/core/commit/aedb205c79395de77127fb7166b29b09319df23c https://github.com/dovecot/core/commit/874817b169d19a4ae51d80ad5798a396bfe90136 https://github.com/dovecot/core/commit/5efeccc10beccbf8d7700adec1278f97d416cbc6 https://github.com/dovecot/core/commit/2b4f1e47a4ca8a192bf3f7e944c0ad07b21b2ed1 https://github.com/dovecot/core/commit/563bf21d8228a3c06c63b3f289a90ca3d0c579a4 https://github.com/dovecot/core/commit/18d5837748d3eafe56e080653d5ed0b3e221be0b https://github.com/dovecot/core/commit/063462d588eaea6f266596fae5f5470792dcc98d https://github.com/dovecot/core/commit/b34002a4ca301ed94cd944ee3504287ed7e58031 https://github.com/dovecot/core/commit/92d9690da195b6ceaa878ab1df6c7c31a75f63f8 https://github.com/dovecot/core/commit/cbab48f174580bfb8d49321d8d336f96a231b0cd https://security.archlinux.org/CVE-2020-10957 https://security.archlinux.org/CVE-2020-10958 https://security.archlinux.org/CVE-2020-10967