CVE-2020-10967 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 87%

Affected Products (NVD)

Vendor	Product	Version
dovecot	dovecot	𝑥 < 2.3.10.1

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

dovecot

bookworm	1:2.3.19.1+dfsg1-2.1+deb12u1 fixed
bookworm (security)	1:2.3.19.1+dfsg1-2.1+deb12u1 fixed
bullseye	1:2.3.13+dfsg1-2+deb11u1 fixed
bullseye (security)	1:2.3.13+dfsg1-2+deb11u2 fixed
jessie	not-affected
sid	1:2.3.21.1+dfsg1-1 fixed
stretch	not-affected
trixie	1:2.3.21.1+dfsg1-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

dovecot

bionic	not-affected
eoan	Fixed 1:2.3.4.1-5ubuntu3.1 released
focal	Fixed 1:2.3.7.2-1ubuntu3.1 released
trusty	not-affected
xenial	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

dovecot23

suse enterprise sap 15 SP1	2.3.10-11.1 fixed
suse enterprise sap 15 SP2	2.3.10-15.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise sap 15 SP4	2.3.15-58.3 fixed
suse enterprise sap 15 SP7	2.3.15-150200.65.1 fixed
suse enterprise server 15	2.3.10-4.22.1 fixed
suse enterprise server 15 SP1	2.3.10-11.1 fixed
suse enterprise server 15 SP2	2.3.10-15.1 fixed
suse enterprise server 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise server 15 SP4	2.3.15-58.3 fixed
suse enterprise server 15 SP7	2.3.15-150200.65.1 fixed

dovecot23-backend-mysql

suse enterprise sap 15 SP1	2.3.10-11.1 fixed
suse enterprise sap 15 SP2	2.3.10-15.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise sap 15 SP4	2.3.15-58.3 fixed
suse enterprise sap 15 SP7	2.3.15-150200.65.1 fixed
suse enterprise server 15	2.3.10-4.22.1 fixed
suse enterprise server 15 SP1	2.3.10-11.1 fixed
suse enterprise server 15 SP2	2.3.10-15.1 fixed
suse enterprise server 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise server 15 SP4	2.3.15-58.3 fixed
suse enterprise server 15 SP7	2.3.15-150200.65.1 fixed

dovecot23-backend-pgsql

suse enterprise sap 15 SP1	2.3.10-11.1 fixed
suse enterprise sap 15 SP2	2.3.10-15.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise sap 15 SP4	2.3.15-58.3 fixed
suse enterprise sap 15 SP7	2.3.15-150200.65.1 fixed
suse enterprise server 15	2.3.10-4.22.1 fixed
suse enterprise server 15 SP1	2.3.10-11.1 fixed
suse enterprise server 15 SP2	2.3.10-15.1 fixed
suse enterprise server 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise server 15 SP4	2.3.15-58.3 fixed
suse enterprise server 15 SP7	2.3.15-150200.65.1 fixed

dovecot23-backend-sqlite

suse enterprise sap 15 SP1	2.3.10-11.1 fixed
suse enterprise sap 15 SP2	2.3.10-15.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise sap 15 SP4	2.3.15-58.3 fixed
suse enterprise sap 15 SP7	2.3.15-150200.65.1 fixed
suse enterprise server 15	2.3.10-4.22.1 fixed
suse enterprise server 15 SP1	2.3.10-11.1 fixed
suse enterprise server 15 SP2	2.3.10-15.1 fixed
suse enterprise server 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise server 15 SP4	2.3.15-58.3 fixed
suse enterprise server 15 SP7	2.3.15-150200.65.1 fixed

dovecot23-devel

suse enterprise sap 15 SP1	2.3.10-11.1 fixed
suse enterprise sap 15 SP2	2.3.10-15.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise sap 15 SP4	2.3.15-58.3 fixed
suse enterprise sap 15 SP7	2.3.15-150200.65.1 fixed
suse enterprise server 15	2.3.10-4.22.1 fixed
suse enterprise server 15 SP1	2.3.10-11.1 fixed
suse enterprise server 15 SP2	2.3.10-15.1 fixed
suse enterprise server 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise server 15 SP4	2.3.15-58.3 fixed
suse enterprise server 15 SP7	2.3.15-150200.65.1 fixed

dovecot23-fts

suse enterprise sap 15 SP1	2.3.10-11.1 fixed
suse enterprise sap 15 SP2	2.3.10-15.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise sap 15 SP4	2.3.15-58.3 fixed
suse enterprise sap 15 SP7	2.3.15-150200.65.1 fixed
suse enterprise server 15	2.3.10-4.22.1 fixed
suse enterprise server 15 SP1	2.3.10-11.1 fixed
suse enterprise server 15 SP2	2.3.10-15.1 fixed
suse enterprise server 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise server 15 SP4	2.3.15-58.3 fixed
suse enterprise server 15 SP7	2.3.15-150200.65.1 fixed

dovecot23-fts-lucene

suse enterprise sap 15 SP1	2.3.10-11.1 fixed
suse enterprise sap 15 SP2	2.3.10-15.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise sap 15 SP4	2.3.15-58.3 fixed
suse enterprise sap 15 SP7	2.3.15-150200.65.1 fixed
suse enterprise server 15	2.3.10-4.22.1 fixed
suse enterprise server 15 SP1	2.3.10-11.1 fixed
suse enterprise server 15 SP2	2.3.10-15.1 fixed
suse enterprise server 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise server 15 SP4	2.3.15-58.3 fixed
suse enterprise server 15 SP7	2.3.15-150200.65.1 fixed

dovecot23-fts-solr

suse enterprise sap 15 SP1	2.3.10-11.1 fixed
suse enterprise sap 15 SP2	2.3.10-15.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise sap 15 SP4	2.3.15-58.3 fixed
suse enterprise sap 15 SP7	2.3.15-150200.65.1 fixed
suse enterprise server 15	2.3.10-4.22.1 fixed
suse enterprise server 15 SP1	2.3.10-11.1 fixed
suse enterprise server 15 SP2	2.3.10-15.1 fixed
suse enterprise server 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise server 15 SP4	2.3.15-58.3 fixed
suse enterprise server 15 SP7	2.3.15-150200.65.1 fixed

dovecot23-fts-squat

suse enterprise sap 15 SP1	2.3.10-11.1 fixed
suse enterprise sap 15 SP2	2.3.10-15.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise sap 15 SP4	2.3.15-58.3 fixed
suse enterprise sap 15 SP7	2.3.15-150200.65.1 fixed
suse enterprise server 15	2.3.10-4.22.1 fixed
suse enterprise server 15 SP1	2.3.10-11.1 fixed
suse enterprise server 15 SP2	2.3.10-15.1 fixed
suse enterprise server 15 SP3	2.3.11.3-17.5.1 fixed
suse enterprise server 15 SP4	2.3.15-58.3 fixed
suse enterprise server 15 SP7	2.3.15-150200.65.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

dovecot

RHEL 8

1:2.3.8-4.el8

fixed

dovecot-devel

RHEL 8

1:2.3.8-4.el8

fixed

dovecot-mysql

RHEL 8

1:2.3.8-4.el8

fixed

dovecot-pgsql

RHEL 8

1:2.3.8-4.el8

fixed

dovecot-pigeonhole

RHEL 8

1:2.3.8-4.el8

fixed

Known Exploits!

Common Weakness Enumeration

CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00059.html

http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Dereference-Denial-Of-Service.html

http://seclists.org/fulldisclosure/2020/May/37

http://www.openwall.com/lists/oss-security/2020/05/18/1

https://dovecot.org/security

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4AAX2MJEULPVSRZOBX3PNPFSYP4FM4TT/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYZU6CHA3VMYYAUCMHSCCQKJEVEIKPQ2/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TTZN2VW55ZC2AQBGBJMLRJSZIKSB2NS6/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWHUUAFPC6XGIXYFIPTNBXLHPNM4W6/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XKKAL3OMG76ZZ7CIEMQP2K6KCTD2RAKE/

https://usn.ubuntu.com/4361-1/

https://www.debian.org/security/2020/dsa-4690

https://www.openwall.com/lists/oss-security/2020/05/18/1

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00059.html

http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Dereference-Denial-Of-Service.html

http://seclists.org/fulldisclosure/2020/May/37

http://www.openwall.com/lists/oss-security/2020/05/18/1

https://dovecot.org/security

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4AAX2MJEULPVSRZOBX3PNPFSYP4FM4TT/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYZU6CHA3VMYYAUCMHSCCQKJEVEIKPQ2/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TTZN2VW55ZC2AQBGBJMLRJSZIKSB2NS6/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWHUUAFPC6XGIXYFIPTNBXLHPNM4W6/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XKKAL3OMG76ZZ7CIEMQP2K6KCTD2RAKE/

https://usn.ubuntu.com/4361-1/

https://www.debian.org/security/2020/dsa-4690

https://www.openwall.com/lists/oss-security/2020/05/18/1