Security
Security
Multiple vulnerabilities have been found in Dovecot, the worst of which could allow remote attackers to cause a Denial of Service condition.
| Package | net-mail/dovecot on all architectures |
|---|---|
| Affected versions | < 2.3.13 |
| Unaffected versions | >= 2.3.13 |
Dovecot is an open source IMAP and POP3 email server.
Multiple vulnerabilities have been discovered in Dovecot. Please review the CVE identifiers referenced below for details.
A remote attacker could send a specially crafted mail or send a specially crafted IMAP command possibly resulting in a Denial of Service condition or an authenticated remote attacker might be able to discover the file system directory structure and access other users’ emails.
The information disclosure vulnerability can be mitigated by disabling IMAP hibernation feature which isn’t enabled by default.
All Dovecot users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.3.13"
Release date
January 10, 2021
Latest revision
January 10, 2021: 1
Severity
normal
Exploitable
local, remote
Bugzilla entries