In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade dovecotUpgrade dovecot-devel | May 4, 2022 | May 18, 2020 |
| Alpine Linux | — | Upgrade dovecot | Jun 16, 2020 | May 18, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 18, 2020 |
| Centos_linux | — | Upgrade dovecot-debugsourceUpgrade dovecot-pgsqlUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-mysqlUpgrade dovecot-mysql-debuginfoUpgrade dovecotUpgrade dovecot-pigeonholeUpgrade dovecot-debuginfoUpgrade dovecot-pigeonhole-debuginfo | Nov 5, 2020 | May 18, 2020 |
| Debian | — | Upgrade dovecot | May 22, 2020 | May 18, 2020 |
| Freebsd | — | Upgrade dovecot | May 19, 2020 | May 18, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade dovecot-mysqlUpgrade dovecotUpgrade dovecot-pigeonhole | Aug 31, 2020 | May 18, 2020 |
| Oracle_linux | — | Upgrade dovecotUpgrade dovecot-pgsqlUpgrade dovecot-mysqlUpgrade dovecot-develUpgrade dovecot-pigeonhole | Nov 12, 2020 | May 18, 2020 |
| Redhat_linux | — | Upgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-pigeonholeUpgrade dovecot-mysql-debuginfoUpgrade dovecot-debuginfoUpgrade dovecot-mysqlUpgrade dovecot-develUpgrade dovecotUpgrade dovecot-pgsqlUpgrade dovecot-debugsourceUpgrade dovecot-pgsql-debuginfo | Nov 5, 2020 | May 18, 2020 |
| Suse | — | Upgrade dovecot23-develUpgrade dovecot23-backend-pgsqlUpgrade dovecot23-fts-solrUpgrade dovecot23-backend-sqliteUpgrade dovecot23-backend-mysqlUpgrade dovecot23-ftsUpgrade dovecot23-fts-squatUpgrade dovecot23Upgrade dovecot23-fts-lucene | May 23, 2020 | May 18, 2020 |
| Ubuntu | — | Upgrade dovecot-core | May 19, 2020 | May 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub