File _patchinfo of Package patchinfo.17733

<patchinfo incident="17733">
  <issue tracker="bnc" id="1174920">VUL-0: CVE-2020-12100: dovecot22,dovecot23: nested MIME parts leads to resource exhaustion</issue>
  <issue tracker="bnc" id="1174922">VUL-0: CVE-2020-12673: dovecot22,dovecot23: improper implementation of NTLM does not check message buffer size</issue>
  <issue tracker="bnc" id="1174923">VUL-0: CVE-2020-12674: dovecot22,dovecot23: improper implementation of RPA mechanism</issue>
  <issue tracker="bnc" id="1180405">VUL-0: EMBARGOED: CVE-2020-24386: dovecot: IMAP hibernation allows users to access other users' emails</issue>
  <issue tracker="bnc" id="1180406">VUL-1: EMBARGOED: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing crashed when the 10 000th MIME part was message/rfc822</issue>
  <issue tracker="cve" id="2020-12100"/>
  <issue tracker="cve" id="2020-12673"/>
  <issue tracker="cve" id="2020-12674"/>
  <issue tracker="cve" id="2020-24386"/>
  <issue tracker="cve" id="2020-25275"/>
  <packager>varkoly</packager>
  <rating>important</rating>
  <category>security</category>
  <summary>Security update for dovecot23</summary>
  <description>This update for dovecot23 fixes the following issues:

Security issues fixed:

- CVE-2020-12100: Fixed a resource exhaustion caused by deeply nested MIME parts (bsc#1174920).
- CVE-2020-12673: Fixed an improper implementation of NTLM that did not check the message buffer size (bsc#1174922).
- CVE-2020-12674: Fixed an improper implementation of the RPA mechanism (bsc#1174923).
- CVE-2020-24386: Fixed an issue with IMAP hibernation that allowed users to access other users' emails (bsc#1180405).
- CVE-2020-25275: Fixed a crash when the 10000th MIME part was message/rfc822 (bsc#1180406).

Non-security issues fixed:

- Pigeonhole was updated to version 0.5.11.
- Dovecot was updated to version 2.3.11.3.
</description>
</patchinfo>