Bug 1866313 (CVE-2020-12673)
Summary: | CVE-2020-12673 dovecot: Out of bound reads in dovecot NTLM implementation | ||||||
---|---|---|---|---|---|---|---|
Product: | [Other] Security Response | Reporter: | Huzaifa S. Sidhpurwala <huzaifas> | ||||
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
Status: | CLOSED ERRATA | QA Contact: | |||||
Severity: | high | Docs Contact: | |||||
Priority: | high | ||||||
Version: | unspecified | CC: | anon.amish, bennie.joubert, janfrode, mhlavink, security-response-team | ||||
Target Milestone: | --- | Keywords: | Security | ||||
Target Release: | --- | ||||||
Hardware: | All | ||||||
OS: | Linux | ||||||
Whiteboard: | |||||||
Fixed In Version: | dovecot 2.3.11 | Doc Type: | If docs needed, set a value | ||||
Doc Text: |
A flaw was found in dovecot. An out-of-bounds read flaw was found in the way dovecot handled NTLM authentication allowing an attacker to crash the dovecot auth process repeatedly preventing login. The highest threat from this vulnerability is to system availability.
|
Story Points: | --- | ||||
Clone Of: | Environment: | ||||||
Last Closed: | 2020-09-03 13:17:46 UTC | Type: | --- | ||||
Regression: | --- | Mount Type: | --- | ||||
Documentation: | --- | CRM: | |||||
Verified Versions: | Category: | --- | |||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
Cloudforms Team: | --- | Target Upstream Version: | |||||
Embargoed: | |||||||
Bug Depends On: | 1866757, 1866758, 1866759, 1866760, 1866761, 1868540, 1871843 | ||||||
Bug Blocks: | 1866310 | ||||||
Attachments: |
|
Description
Huzaifa S. Sidhpurwala
2020-08-05 10:55:27 UTC
Created attachment 1710594 [details]
Upstream patch
Mitigation: Upstream suggests that this flaw can be mitigated by disabling NTLM authentication. NTLM authentication can be disabled by using the configuration parameter "auth_mechanisms". More details available at: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/ Acknowledgments: Name: the Dovecot project External References: https://dovecot.org/pipermail/dovecot-news/2020-August/000442.html Created dovecot tracking bugs for this issue: Affects: fedora-all [bug 1868540] This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:3617 https://access.redhat.com/errata/RHSA-2020:3617 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-12673 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:3713 https://access.redhat.com/errata/RHSA-2020:3713 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:3735 https://access.redhat.com/errata/RHSA-2020:3735 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2020:3736 https://access.redhat.com/errata/RHSA-2020:3736 |