Dovecot: Multiple vulnerabilities

Dovecot: Multiple vulnerabilities Multiple vulnerabilities have been found in Dovecot, the worst of which could allow remote attackers to cause a Denial of Service condition. dovecot 2021-01-10 2021-01-10 763525 local, remote 2.3.13 2.3.13

Dovecot is an open source IMAP and POP3 email server.

Multiple vulnerabilities have been discovered in Dovecot. Please review the CVE identifiers referenced below for details.

A remote attacker could send a specially crafted mail or send a specially crafted IMAP command possibly resulting in a Denial of Service condition or an authenticated remote attacker might be able to discover the file system directory structure and access other users’ emails.

The information disclosure vulnerability can be mitigated by disabling IMAP hibernation feature which isn’t enabled by default.

All Dovecot users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.3.13"

CVE-2020-24386 CVE-2020-25275 whissi whissi