Bug 1866317 (CVE-2020-12674)

Summary: CVE-2020-12674 dovecot: Crash due to assert in RPA implementation
Product: [Other] Security Response Reporter: Huzaifa S. Sidhpurwala <huzaifas>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anon.amish, bennie.joubert, janfrode, mhlavink, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: dovecot 2.3.11 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in dovecot. An attacker can use the way dovecot handles RPA (Remote Passphrase Authentication) to crash the authentication process repeatedly preventing login. The highest threat from this vulnerability is to system availability.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-09-03 13:17:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1866764, 1866765, 1866766, 1866767, 1866768, 1868541, 1871842    
Bug Blocks: 1866310    
Attachments:
Description Flags
Upstream patch none

Description Huzaifa S. Sidhpurwala 2020-08-05 11:01:12 UTC
As per upstream:


Vulnerability Details:
Dovecot's RPA mechanism implementation accepts zero-length message, which leads to assert-crash later on

Risk:
An adversary can use this vulnerability to crash dovecot auth process repeatedly, preventing login.

Comment 3 Huzaifa S. Sidhpurwala 2020-08-06 04:27:58 UTC
Created attachment 1710595 [details]
Upstream patch

Comment 7 Huzaifa S. Sidhpurwala 2020-08-06 09:33:18 UTC
Acknowledgments:

Name: the Dovecot project

Comment 8 Eric Christensen 2020-08-11 17:54:28 UTC
Mitigation:

Upstream suggests that this flaw can be mitigated by disabling RPA (Remote Passphrase Authentication). RPA can be disabled by using the configuration parameter "auth_mechanisms". More details available at: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/

Comment 9 Huzaifa S. Sidhpurwala 2020-08-13 03:57:28 UTC
External References:

https://dovecot.org/pipermail/dovecot-news/2020-August/000443.html

Comment 10 Huzaifa S. Sidhpurwala 2020-08-13 03:58:59 UTC
Created dovecot tracking bugs for this issue:

Affects: fedora-all [bug 1868541]

Comment 11 Huzaifa S. Sidhpurwala 2020-08-13 04:09:59 UTC
Upstream patch: https://github.com/dovecot/core/commit/69ad3c902ea4bbf9f21ab1857d8923f975dc6145

Comment 15 errata-xmlrpc 2020-09-03 10:34:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3617 https://access.redhat.com/errata/RHSA-2020:3617

Comment 16 Product Security DevOps Team 2020-09-03 13:17:49 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-12674

Comment 21 errata-xmlrpc 2020-09-10 12:59:59 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:3713 https://access.redhat.com/errata/RHSA-2020:3713

Comment 24 errata-xmlrpc 2020-09-14 12:42:40 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:3735 https://access.redhat.com/errata/RHSA-2020:3735

Comment 25 errata-xmlrpc 2020-09-14 12:46:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2020:3736 https://access.redhat.com/errata/RHSA-2020:3736