Bug 1866309 (CVE-2020-12100) - CVE-2020-12100 dovecot: Resource exhaustion via deeply nested MIME parts
Summary: CVE-2020-12100 dovecot: Resource exhaustion via deeply nested MIME parts
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-12100
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1866751 1866752 1866753 1866754 1866755 1866756 1868539 1871841
Blocks: 1866310
TreeView+ depends on / blocked
 
Reported: 2020-08-05 10:51 UTC by Huzaifa S. Sidhpurwala
Modified: 2021-02-16 19:32 UTC (History)
5 users (show)

Fixed In Version: dovecot 2.3.11
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in dovecot. A remote attacker could cause a denial of service by repeatedly sending emails containing MIME parts containing malicious content of which dovecot will attempt to parse. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2020-09-03 13:17:44 UTC
Embargoed:

Attachments (Terms of Use)
CVE-2020-12100 patch from upstream (115.30 KB, patch)
2020-08-06 03:39 UTC, Huzaifa S. Sidhpurwala 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:3617 0 None None None 2020-09-03 10:34:41 UTC
Red Hat Product Errata RHSA-2020:3713 0 None None None 2020-09-10 12:59:59 UTC
Red Hat Product Errata RHSA-2020:3735 0 None None None 2020-09-14 12:42:41 UTC
Red Hat Product Errata RHSA-2020:3736 0 None None None 2020-09-14 12:46:08 UTC

Description Huzaifa S. Sidhpurwala 2020-08-05 10:51:43 UTC 
As per upstream:

Vulnerability Details:
Receiving mail with deeply nested MIME parts leads to resource exhaustion as Dovecot attempts to parse it.

Risk:
Malicious actor can cause denial of service to mail delivery by repeatedly sending mails with bad content.
Comment 2 Huzaifa S. Sidhpurwala 2020-08-06 03:39:37 UTC 
Created attachment 1710593 [details]
CVE-2020-12100 patch from upstream
Comment 4 Huzaifa S. Sidhpurwala 2020-08-06 03:47:10 UTC 
Mitigation:

Upstream suggests that this flaw can be mitigated by limiting MIME structures in MTA
Comment 6 Huzaifa S. Sidhpurwala 2020-08-06 09:33:03 UTC 
Acknowledgments:

Name: the Dovecot project
Comment 7 Huzaifa S. Sidhpurwala 2020-08-13 03:47:39 UTC 
External References:

https://dovecot.org/pipermail/dovecot-news/2020-August/000441.html
Comment 8 Huzaifa S. Sidhpurwala 2020-08-13 03:50:54 UTC 
Created dovecot tracking bugs for this issue:

Affects: fedora-all [bug 1868539]
Comment 12 errata-xmlrpc 2020-09-03 10:34:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3617 https://access.redhat.com/errata/RHSA-2020:3617
Comment 13 Product Security DevOps Team 2020-09-03 13:17:44 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-12100
Comment 18 errata-xmlrpc 2020-09-10 12:59:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:3713 https://access.redhat.com/errata/RHSA-2020:3713
Comment 21 errata-xmlrpc 2020-09-14 12:42:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:3735 https://access.redhat.com/errata/RHSA-2020:3735
Comment 22 errata-xmlrpc 2020-09-14 12:46:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2020:3736 https://access.redhat.com/errata/RHSA-2020:3736
Note You need to log in before you can comment on or make changes to this bug.