Filtered by vendor Dovecot
Subscribe
Search
Total
14 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-30550 | 2 Debian, Dovecot | 2 Debian Linux, Dovecot | 2024-01-12 | N/A | 8.8 HIGH |
| An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user. | |||||
| CVE-2020-7046 | 2 Dovecot, Fedoraproject | 2 Dovecot, Fedora | 2021-12-30 | 7.8 HIGH | 7.5 HIGH |
| lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop. | |||||
| CVE-2020-25275 | 2 Debian, Dovecot | 2 Debian Linux, Dovecot | 2021-01-20 | 5.0 MEDIUM | 7.5 HIGH |
| Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts. | |||||
| CVE-2020-12100 | 2 Debian, Dovecot | 2 Debian Linux, Dovecot | 2021-01-06 | 5.0 MEDIUM | 7.5 HIGH |
| In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME parts. | |||||
| CVE-2020-12673 | 3 Canonical, Debian, Dovecot | 3 Ubuntu Linux, Debian Linux, Dovecot | 2020-10-13 | 5.0 MEDIUM | 7.5 HIGH |
| In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read. | |||||
| CVE-2020-12674 | 2 Debian, Dovecot | 2 Debian Linux, Dovecot | 2020-10-13 | 5.0 MEDIUM | 7.5 HIGH |
| In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled. | |||||
| CVE-2019-11494 | 1 Dovecot | 1 Dovecot | 2020-08-24 | 5.0 MEDIUM | 7.5 HIGH |
| In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects prematurely during the AUTH command. | |||||
| CVE-2019-10691 | 2 Dovecot, Opensuse | 2 Dovecot, Leap | 2020-08-24 | 5.0 MEDIUM | 7.5 HIGH |
| The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username. | |||||
| CVE-2019-11499 | 1 Dovecot | 1 Dovecot | 2020-08-24 | 5.0 MEDIUM | 7.5 HIGH |
| In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted over a TLS secured channel with an unacceptable authentication message. | |||||
| CVE-2020-10957 | 1 Dovecot | 1 Dovecot | 2020-05-28 | 5.0 MEDIUM | 7.5 HIGH |
| In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp. | |||||
| CVE-2017-2669 | 2 Debian, Dovecot | 2 Debian Linux, Dovecot | 2019-10-09 | 5.0 MEDIUM | 7.5 HIGH |
| Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang. | |||||
| CVE-2017-15132 | 3 Canonical, Debian, Dovecot | 3 Ubuntu Linux, Debian Linux, Dovecot | 2019-10-09 | 5.0 MEDIUM | 7.5 HIGH |
| A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion. | |||||
| CVE-2019-7524 | 4 Canonical, Debian, Dovecot and 1 more | 4 Ubuntu Linux, Debian Linux, Dovecot and 1 more | 2019-06-14 | 7.2 HIGH | 7.8 HIGH |
| In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components. | |||||
| CVE-2017-14461 | 3 Debian, Dovecot, Ubuntu | 3 Debian Linux, Dovecot, Ubuntu | 2018-04-04 | 5.5 MEDIUM | 7.1 HIGH |
| A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server. | |||||