Security update for dovecot23
This update for dovecot23 fixes the following issues:
Security issues fixed:
- CVE-2020-12100: Fixed a resource exhaustion caused by deeply nested MIME parts (bsc#1174920).
- CVE-2020-24386: Fixed an issue with IMAP hibernation that allowed users to access other users' emails (bsc#1180405).
- CVE-2020-25275: Fixed a crash when the 10000th MIME part was message/rfc822 (bsc#1180406).
Non-security issues fixed:
- Pigeonhole was updated to version 0.5.11.
- Dovecot was updated to version 2.3.11.3.
This update was imported from the SUSE:SLE-15-SP1:Update update project.
-
Submitted by
Peter Varkoly (varkoly)
Fixed bugs
bnc#1174920
VUL-0: CVE-2020-12100: dovecot22,dovecot23: nested MIME parts leads to resource exhaustion
bnc#1180405
VUL-0: EMBARGOED: CVE-2020-24386: dovecot: IMAP hibernation allows users to access other users' emails
bnc#1180406
VUL-1: EMBARGOED: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing crashed when the 10 000th MIME part was message/rfc822
