Bug 1800491 (CVE-2020-7046) - CVE-2020-7046 dovecot: Attacker can cause submission-login and lmtp processes to be exhausted leading to DoS
Summary: CVE-2020-7046 dovecot: Attacker can cause submission-login and lmtp processes...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-7046
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1800498
TreeView+ depends on / blocked
 
Reported: 2020-02-07 09:18 UTC by Marian Rehak
Modified: 2021-02-16 20:38 UTC (History)
6 users (show)

Fixed In Version: dovecot 2.3.9.3
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-02-17 05:37:52 UTC
Embargoed:

Attachments (Terms of Use)

Description Marian Rehak 2020-02-07 09:18:43 UTC 
lib-smtp doesn't handle truncated command parameters properly, resulting in an infinite loop taking 100% CPU for the process and causing a DoS.
Comment 1 Huzaifa S. Sidhpurwala 2020-02-17 05:35:39 UTC 
This issue is already addressed in Fedora via the following updates:

Fedora-30-testing: http://koji.fedoraproject.org/packages/dovecot/2.3.9.3/1.fc30
Fedora-31-testing: http://koji.fedoraproject.org/packages/dovecot/2.3.9.3/1.fc31
Comment 2 Huzaifa S. Sidhpurwala 2020-02-17 05:35:42 UTC 
External References:

https://dovecot.org/pipermail/dovecot-news/2020-February/000431.html
Comment 3 Huzaifa S. Sidhpurwala 2020-02-17 05:37:20 UTC 
Upstream commit:

https://github.com/dovecot/core/commit/ed4b7d5d1b30964216d61d3090a7b47a957f5b26
Note You need to log in before you can comment on or make changes to this bug.