==========================================================================
Ubuntu Security Notice USN-4456-1
August 12, 2020

dovecot vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 20.04 LTS
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Dovecot.

Software Description:
– dovecot: IMAP and POP3 email server

Details:

It was discovered that Dovecot incorrectly handled deeply nested MIME
parts. A remote attacker could possibly use this issue to cause Dovecot to
consume resources, resulting in a denial of service. (CVE-2020-12100)

It was discovered that Dovecot incorrectly handled memory when using NTLM.
A remote attacker could possibly use this issue to cause Dovecot to crash,
resulting in a denial of service. (CVE-2020-12673)

It was discovered that the Dovecot RPA mechanism incorrectly handled
zero-length messages. A remote attacker could possibly use this issue to
cause Dovecot to crash, resulting in a denial of service. (CVE-2020-12674)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
dovecot-core 1:2.3.7.2-1ubuntu3.2

Ubuntu 18.04 LTS:
dovecot-core 1:2.2.33.2-1ubuntu4.6

Ubuntu 16.04 LTS:
dovecot-core 1:2.2.22-1ubuntu2.13

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4456-1
CVE-2020-12100, CVE-2020-12673, CVE-2020-12674

Package Information:
https://launchpad.net/ubuntu/+source/dovecot/1:2.3.7.2-1ubuntu3.2
https://launchpad.net/ubuntu/+source/dovecot/1:2.2.33.2-1ubuntu4.6
https://launchpad.net/ubuntu/+source/dovecot/1:2.2.22-1ubuntu2.13

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl80AsAACgkQZWnYVadE
vpMn/BAAl2OMh467bnEtYHXpkldaTWPvnigcJOCu0pNsDwYxA9UJlJO+Cm//z+O7
Vu3EqB5v/yzLzmWNcmFrWF/ikXnasjQXkj9y2ypvF4oqYvfI9i07nylm3RqZUEgh
MvjnVwM1jY1P70LgiK+3WjBtmp+RliQ0CpK4+7DIo9mAAiGUGFqSjgL0GF/6IM2d
sBMoXq5zrWkW0ee8ARHF4uuFjWNe9HHZ2Dv3YgRBmdCc0JOAeZEOUK3qXNuUoL+j
4hZDYtcglOQ9OAX0GybXVcxPjCwaCAJGCCZYC2iXDKWIZvjKxlbl0alMHzCnv/py
EWpk/TquKFkZciAijsjrhgqBUOOMjcXwJYBKRy8HICdXzoU2tPXN9z6iMeo2bOoL
PEDpGidpQ2BN/RPVeMgrzsMZE+puk/rUYspTh6qwGpoTZIVlPcT8toI/bSMrL8L6
8ZlHNftJUFvRPbZEzFTBgOwqbouQrRpf0UpzFDWL5K8UcMrPeLA5fLu27eQNCwrP
HKVTDOeoP98Em8UD+5y0m5KY4FQwab2DN28Hqzi852NY2zfJMWH9oEp2GEA80Xxg
CJgEgFODc/eWK75ymSecYYJx/an/hickzZjnb2kMVlTY0Y3kCn0xtMfUE30jEEG5
bwsDjiyaFKaY4dO52AQew1GE1LHSm+TzVmx3pv8FEIelqRryEJI=
=ZwxD
—–END PGP SIGNATURE—–
—