Lucene search

K
freebsdFreeBSDBD98066D-4EA4-11EB-B412-E86A64CACA56
HistoryAug 17, 2020 - 12:00 a.m.

mail/dovecot -- multiple vulnerabilities

2020-08-1700:00:00
vuxml.freebsd.org
12

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.036 Low

EPSS

Percentile

91.7%

Aki Tuomi reports:

When imap hibernation is active, an attacker can cause Dovecot to
discover file system directory structure and access other users’
emails using specially crafted command.
The attacker must have valid credentials to access the
mail server.

Mail delivery / parsing crashed when the 10 000th MIME part was
message/rfc822 (or if parent was multipart/digest). This happened
due to earlier MIME parsing changes for CVE-2020-12100.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchdovecot< 2.3.13UNKNOWN

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.036 Low

EPSS

Percentile

91.7%