Synopsis

Important: dovecot security update

Type/Severity

Security Advisory: Important

Topic

An update for dovecot is now available for Red Hat Enterprise Linux 8.1 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

• dovecot: Resource exhaustion via deeply nested MIME parts (CVE-2020-12100)
  
• dovecot: Out of bound reads in dovecot NTLM implementation (CVE-2020-12673)
  
• dovecot: Crash due to assert in RPA implementation (CVE-2020-12674)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1 x86_64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1 s390x
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1 ppc64le
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1 aarch64
• Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.1 ppc64le
• Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.1 x86_64
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.1 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.1 ppc64le
• Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 8.1 s390x
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.1 aarch64

Fixes

• BZ - 1866309 - CVE-2020-12100 dovecot: Resource exhaustion via deeply nested MIME parts
• BZ - 1866313 - CVE-2020-12673 dovecot: Out of bound reads in dovecot NTLM implementation
• BZ - 1866317 - CVE-2020-12674 dovecot: Crash due to assert in RPA implementation

CVEs

• CVE-2020-12100
• CVE-2020-12673
• CVE-2020-12674

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1

SRPM
dovecot-2.2.36-10.el8_1.2.src.rpm	SHA-256: 8ec39efbe0e57a401724958e8e976318883e50ac663b5364d0d226d3b90c520e
x86_64
dovecot-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: f1a7ae0a32a53d9a1d2583c8e7d2c5be394fd29e0adcc0412ef80fa6eb4dc0e2
dovecot-debuginfo-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 2b28d86eff16b775f7d8d57ab078274dd1aee360a5a5922f3cf48ff1e5db2436
dovecot-debugsource-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 4092ec5a530107d4d2918bc22cfc6797f74b0101d76fc4216e9fbc828091dccb
dovecot-mysql-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 49cfdb697eb6cdae69ffa4643d0d6070c24d264f0e2c66af231d1ceaea02671b
dovecot-mysql-debuginfo-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 88fb7ac1d740263d4bfd7fa0c9b2d2a6fcbbd3e0002477ecd9a76c592fde2858
dovecot-pgsql-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 3f26cf26e1862562ff16b5b202fe4b3ce8e78b0e9770cef47b3157da36be52e3
dovecot-pgsql-debuginfo-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 2d47345a307ee4a76bccdedba6f5b8f5d940de9fbb1afd4329b7f232f9def57b
dovecot-pigeonhole-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 930e6e1abff600f789c380125355ef7bbbe89d8de8615b7cc4454ddcadde633c
dovecot-pigeonhole-debuginfo-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 41dec5aa7bea2b1171173e6ed62acabb4b66047e8661368cdb089b510743e233

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1

SRPM
dovecot-2.2.36-10.el8_1.2.src.rpm	SHA-256: 8ec39efbe0e57a401724958e8e976318883e50ac663b5364d0d226d3b90c520e
s390x
dovecot-2.2.36-10.el8_1.2.s390x.rpm	SHA-256: 053a30a9fc15309aca91a3229aa72d60cd9ac69e2a3f1b4ae3d4b4b78f659113
dovecot-debuginfo-2.2.36-10.el8_1.2.s390x.rpm	SHA-256: e640c11e96ea8cfde5bf1da3accaa35776dc64f240df17a533e39aaf67e3d999
dovecot-debugsource-2.2.36-10.el8_1.2.s390x.rpm	SHA-256: 443e99c8c2310340fd2275761943d690cba32489a1a9f2c638fb0133e2969afa
dovecot-mysql-2.2.36-10.el8_1.2.s390x.rpm	SHA-256: b6e4cb1bc32a1f74b1c1379f630545119bea17403eb4d4cdf4b9fa2a2fe0f633
dovecot-mysql-debuginfo-2.2.36-10.el8_1.2.s390x.rpm	SHA-256: 7ff787fe93bc8c95e912f5611520e58fad6eb38a89fc2804f355de7ccc65a118
dovecot-pgsql-2.2.36-10.el8_1.2.s390x.rpm	SHA-256: 5f5c23072551f9dee8f5c50dad6533a00e18fa77a647089ef1146990473e7532
dovecot-pgsql-debuginfo-2.2.36-10.el8_1.2.s390x.rpm	SHA-256: c405ac0fb17b94028714ef6f4a05aafd41bcb3bb5f15bbb251a1bd2215be65cc
dovecot-pigeonhole-2.2.36-10.el8_1.2.s390x.rpm	SHA-256: 52807a5dfb48a0de0318b7804516218dd8d99de6250af36dc18b1dab9dc2a86c
dovecot-pigeonhole-debuginfo-2.2.36-10.el8_1.2.s390x.rpm	SHA-256: f135fcdb465aee830b66e8290d1873d4d7c602de2a96bf39a082db8265088115

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1

SRPM
dovecot-2.2.36-10.el8_1.2.src.rpm	SHA-256: 8ec39efbe0e57a401724958e8e976318883e50ac663b5364d0d226d3b90c520e
ppc64le
dovecot-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: 63cd04d148759486e39c7c2ef477cb2a8a1861211bbb0189b58b096c09d9af47
dovecot-debuginfo-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: b80a4dfc8ea478a08516a3cd63753ad43460e1b20fd017a381f2267e0e55e184
dovecot-debugsource-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: d0ed0b9c594c6b623e19eef81ef18cd66b2f271eb64d8478551b2d3134bbccf4
dovecot-mysql-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: 879d6d6a0fdda52b17f7c50c35f2493466edd966f5e5bd55d055b3a07b313655
dovecot-mysql-debuginfo-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: e58a875f4b593d773ddfc8efdc2d2b683d3be3c4890dd6c1ca9c816549248f14
dovecot-pgsql-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: 978d6d57d96c41679e03ec900c795cfb15e457ab0d2bba3f1a47e0b3fe4334e7
dovecot-pgsql-debuginfo-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: 6b4c2fcbd2a0d98f984a64bf37e329bf9c8d44293738e1613729270c70ffb934
dovecot-pigeonhole-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: ddd683e8c5d02e8a38f3fe253a5eb94548df219797c6f747a97ff560000cce4e
dovecot-pigeonhole-debuginfo-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: 76f57629c2cf7fa9524769c5e678cbd04dc9ef18c4d74facf7dfc95a3787a9da

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1

SRPM
dovecot-2.2.36-10.el8_1.2.src.rpm	SHA-256: 8ec39efbe0e57a401724958e8e976318883e50ac663b5364d0d226d3b90c520e
aarch64
dovecot-2.2.36-10.el8_1.2.aarch64.rpm	SHA-256: df63cd44778822a706b243143f08ddbcfc29f4c4a6087c9f9c578a1d737aa3a3
dovecot-debuginfo-2.2.36-10.el8_1.2.aarch64.rpm	SHA-256: 8d87382bd0691934865646be8adda2bfa620dc88d3ad89a8d9a93bc8c1368412
dovecot-debugsource-2.2.36-10.el8_1.2.aarch64.rpm	SHA-256: d217003902cdc5d6bda6743bb768487d2aa6060b84c4c83dfc4e7cd06e2cec4e
dovecot-mysql-2.2.36-10.el8_1.2.aarch64.rpm	SHA-256: dd9c6b05bc13dcf82896f29655340765d1e44c2b61191c72c95cf4e7be4f0498
dovecot-mysql-debuginfo-2.2.36-10.el8_1.2.aarch64.rpm	SHA-256: 6270077341536ea147c6af6c51ebaa4a3a201cfa5b91ce553273300d662c60a2
dovecot-pgsql-2.2.36-10.el8_1.2.aarch64.rpm	SHA-256: 1f50bb6f603f4a16aa4887eaeafd4b05fc6715fc96a8db71c8a87078ec892a77
dovecot-pgsql-debuginfo-2.2.36-10.el8_1.2.aarch64.rpm	SHA-256: 9bce39f2df58577b8b8e57caa09768ae54f40303dc0e979038d63e3f89df25c8
dovecot-pigeonhole-2.2.36-10.el8_1.2.aarch64.rpm	SHA-256: 7662bcb9ed0f43e49e3932ba45d980ed8c197f5cc536ad2794b6533e650a3814
dovecot-pigeonhole-debuginfo-2.2.36-10.el8_1.2.aarch64.rpm	SHA-256: 4d0f2a57d209dc122c6f9780b82f27e03445e43bdf0f0726f9cc5bf722dfcbae

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.1

SRPM
dovecot-2.2.36-10.el8_1.2.src.rpm	SHA-256: 8ec39efbe0e57a401724958e8e976318883e50ac663b5364d0d226d3b90c520e
ppc64le
dovecot-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: 63cd04d148759486e39c7c2ef477cb2a8a1861211bbb0189b58b096c09d9af47
dovecot-debuginfo-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: b80a4dfc8ea478a08516a3cd63753ad43460e1b20fd017a381f2267e0e55e184
dovecot-debugsource-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: d0ed0b9c594c6b623e19eef81ef18cd66b2f271eb64d8478551b2d3134bbccf4
dovecot-mysql-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: 879d6d6a0fdda52b17f7c50c35f2493466edd966f5e5bd55d055b3a07b313655
dovecot-mysql-debuginfo-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: e58a875f4b593d773ddfc8efdc2d2b683d3be3c4890dd6c1ca9c816549248f14
dovecot-pgsql-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: 978d6d57d96c41679e03ec900c795cfb15e457ab0d2bba3f1a47e0b3fe4334e7
dovecot-pgsql-debuginfo-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: 6b4c2fcbd2a0d98f984a64bf37e329bf9c8d44293738e1613729270c70ffb934
dovecot-pigeonhole-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: ddd683e8c5d02e8a38f3fe253a5eb94548df219797c6f747a97ff560000cce4e
dovecot-pigeonhole-debuginfo-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: 76f57629c2cf7fa9524769c5e678cbd04dc9ef18c4d74facf7dfc95a3787a9da

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.1

SRPM
dovecot-2.2.36-10.el8_1.2.src.rpm	SHA-256: 8ec39efbe0e57a401724958e8e976318883e50ac663b5364d0d226d3b90c520e
x86_64
dovecot-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: f1a7ae0a32a53d9a1d2583c8e7d2c5be394fd29e0adcc0412ef80fa6eb4dc0e2
dovecot-debuginfo-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 2b28d86eff16b775f7d8d57ab078274dd1aee360a5a5922f3cf48ff1e5db2436
dovecot-debugsource-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 4092ec5a530107d4d2918bc22cfc6797f74b0101d76fc4216e9fbc828091dccb
dovecot-mysql-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 49cfdb697eb6cdae69ffa4643d0d6070c24d264f0e2c66af231d1ceaea02671b
dovecot-mysql-debuginfo-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 88fb7ac1d740263d4bfd7fa0c9b2d2a6fcbbd3e0002477ecd9a76c592fde2858
dovecot-pgsql-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 3f26cf26e1862562ff16b5b202fe4b3ce8e78b0e9770cef47b3157da36be52e3
dovecot-pgsql-debuginfo-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 2d47345a307ee4a76bccdedba6f5b8f5d940de9fbb1afd4329b7f232f9def57b
dovecot-pigeonhole-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 930e6e1abff600f789c380125355ef7bbbe89d8de8615b7cc4454ddcadde633c
dovecot-pigeonhole-debuginfo-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 41dec5aa7bea2b1171173e6ed62acabb4b66047e8661368cdb089b510743e233

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.1

SRPM
x86_64
dovecot-2.2.36-10.el8_1.2.i686.rpm	SHA-256: f253de9f1b6e62d08547fbb3958c99c30fbbe792fcf3e9f92f356030747f6f9c
dovecot-debuginfo-2.2.36-10.el8_1.2.i686.rpm	SHA-256: 31bb5c3a6fef086127d102bcfc3600bbacb0e2f25ff55d169c646f1dc9fc2f03
dovecot-debuginfo-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 2b28d86eff16b775f7d8d57ab078274dd1aee360a5a5922f3cf48ff1e5db2436
dovecot-debugsource-2.2.36-10.el8_1.2.i686.rpm	SHA-256: 5b9ea8c662b92313d20412dfa80ddd35a8a1dac77cbe2e03ac8af5924f914067
dovecot-debugsource-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 4092ec5a530107d4d2918bc22cfc6797f74b0101d76fc4216e9fbc828091dccb
dovecot-devel-2.2.36-10.el8_1.2.i686.rpm	SHA-256: 0749bcedeedaf3382ad1da76290532521409a8ef64fcd22a85573735f08abfff
dovecot-devel-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: ff14f46bbbe921242d84b3cf560795cf0c64fc4f2e81b9d44ab8ee9a4f9dac6a
dovecot-mysql-debuginfo-2.2.36-10.el8_1.2.i686.rpm	SHA-256: ab48faa567e73de8b9eeae69ae7bb60ec140fe2fa7fcf009f7501ebaeb0f6bba
dovecot-mysql-debuginfo-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 88fb7ac1d740263d4bfd7fa0c9b2d2a6fcbbd3e0002477ecd9a76c592fde2858
dovecot-pgsql-debuginfo-2.2.36-10.el8_1.2.i686.rpm	SHA-256: 68ab615317556fe090c81a053915daed06f3a2840481b4e37e784452e67588ae
dovecot-pgsql-debuginfo-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 2d47345a307ee4a76bccdedba6f5b8f5d940de9fbb1afd4329b7f232f9def57b
dovecot-pigeonhole-debuginfo-2.2.36-10.el8_1.2.i686.rpm	SHA-256: c5cc45f54000ae634fdc7085a954733909664e5378fd6c2071c51273d381edbe
dovecot-pigeonhole-debuginfo-2.2.36-10.el8_1.2.x86_64.rpm	SHA-256: 41dec5aa7bea2b1171173e6ed62acabb4b66047e8661368cdb089b510743e233

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.1

SRPM
ppc64le
dovecot-debuginfo-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: b80a4dfc8ea478a08516a3cd63753ad43460e1b20fd017a381f2267e0e55e184
dovecot-debugsource-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: d0ed0b9c594c6b623e19eef81ef18cd66b2f271eb64d8478551b2d3134bbccf4
dovecot-devel-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: fedf86472c279e6738b300c0d753f1ba962d446ec5b6d29655365d0473d9e809
dovecot-mysql-debuginfo-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: e58a875f4b593d773ddfc8efdc2d2b683d3be3c4890dd6c1ca9c816549248f14
dovecot-pgsql-debuginfo-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: 6b4c2fcbd2a0d98f984a64bf37e329bf9c8d44293738e1613729270c70ffb934
dovecot-pigeonhole-debuginfo-2.2.36-10.el8_1.2.ppc64le.rpm	SHA-256: 76f57629c2cf7fa9524769c5e678cbd04dc9ef18c4d74facf7dfc95a3787a9da

Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 8.1

SRPM
s390x
dovecot-debuginfo-2.2.36-10.el8_1.2.s390x.rpm	SHA-256: e640c11e96ea8cfde5bf1da3accaa35776dc64f240df17a533e39aaf67e3d999
dovecot-debugsource-2.2.36-10.el8_1.2.s390x.rpm	SHA-256: 443e99c8c2310340fd2275761943d690cba32489a1a9f2c638fb0133e2969afa
dovecot-devel-2.2.36-10.el8_1.2.s390x.rpm	SHA-256: a9948e7e58f999c701c96f70946d6aa2073db5231a3c221344473dddf04792d9
dovecot-mysql-debuginfo-2.2.36-10.el8_1.2.s390x.rpm	SHA-256: 7ff787fe93bc8c95e912f5611520e58fad6eb38a89fc2804f355de7ccc65a118
dovecot-pgsql-debuginfo-2.2.36-10.el8_1.2.s390x.rpm	SHA-256: c405ac0fb17b94028714ef6f4a05aafd41bcb3bb5f15bbb251a1bd2215be65cc
dovecot-pigeonhole-debuginfo-2.2.36-10.el8_1.2.s390x.rpm	SHA-256: f135fcdb465aee830b66e8290d1873d4d7c602de2a96bf39a082db8265088115

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.1

SRPM
aarch64
dovecot-debuginfo-2.2.36-10.el8_1.2.aarch64.rpm	SHA-256: 8d87382bd0691934865646be8adda2bfa620dc88d3ad89a8d9a93bc8c1368412
dovecot-debugsource-2.2.36-10.el8_1.2.aarch64.rpm	SHA-256: d217003902cdc5d6bda6743bb768487d2aa6060b84c4c83dfc4e7cd06e2cec4e
dovecot-devel-2.2.36-10.el8_1.2.aarch64.rpm	SHA-256: c8bec5e9528fefcba8aca14cb72fc8c406b0e4eae9ecd51976e6192ba2d5e913
dovecot-mysql-debuginfo-2.2.36-10.el8_1.2.aarch64.rpm	SHA-256: 6270077341536ea147c6af6c51ebaa4a3a201cfa5b91ce553273300d662c60a2
dovecot-pgsql-debuginfo-2.2.36-10.el8_1.2.aarch64.rpm	SHA-256: 9bce39f2df58577b8b8e57caa09768ae54f40303dc0e979038d63e3f89df25c8
dovecot-pigeonhole-debuginfo-2.2.36-10.el8_1.2.aarch64.rpm	SHA-256: 4d0f2a57d209dc122c6f9780b82f27e03445e43bdf0f0726f9cc5bf722dfcbae