| Package | dovecot |
|---|---|
| Version | 1:2.2.13-12~deb8u8 |
| Related CVEs | CVE-2020-12100 CVE-2020-12673 CVE-2020-12674 |
Several vulnerabilities have been discovered in the Dovecot email server.
CVE-2020-12100
Receiving mail with deeply nested MIME parts leads to resource
exhaustion as Dovecot attempts to parse it.
CVE-2020-12673
Dovecot's NTLM implementation does not correctly check message
buffer size, which leads to a crash when reading past allocation.
CVE-2020-12674
Dovecot's RPA mechanism implementation accepts zero-length message,
which leads to assert-crash later on.
For Debian 8 jessie, these problems have been fixed in version 1:2.2.13-12~deb8u8.
We recommend that you upgrade your dovecot packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.