Issued:
2020-11-03
Updated:
2020-11-03

RHSA-2020:4763 - Security Advisory

Synopsis

Moderate: dovecot security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for dovecot is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

  • dovecot: command followed by sufficient number of newlines leads to use-after-free (CVE-2020-10958)
  • dovecot: sending mail with empty quoted localpart leads to DoS (CVE-2020-10967)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 8 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x

Fixes

  • BZ - 1834323 - CVE-2020-10958 dovecot: command followed by sufficient number of newlines leads to use-after-free
  • BZ - 1834326 - CVE-2020-10967 dovecot: sending mail with empty quoted localpart leads to DoS

Red Hat Enterprise Linux for x86_64 8

SRPM
dovecot-2.3.8-4.el8.src.rpm SHA-256: f3f6fe98b9b3ae611fb2637bdb34d8ec38d6511bbf0e69758783a979c64e6e4d
x86_64
dovecot-2.3.8-4.el8.x86_64.rpm SHA-256: b11ef2cd2c28385ad17c43815ef473d0e79953bee75bc8d36f2691376f509221
dovecot-debuginfo-2.3.8-4.el8.x86_64.rpm SHA-256: 37161f3bf8e0d6f7fb705029ad50d18a4056013857ac216172d20547d5bbaf92
dovecot-debugsource-2.3.8-4.el8.x86_64.rpm SHA-256: aa3890d55c940a33004c8f8ffc7ea91c6eb95ef0eded85eba13a059b5f64ec60
dovecot-mysql-2.3.8-4.el8.x86_64.rpm SHA-256: 1e69d17b40dd4f86020758318bcead5d66991a6a8188beb7bdc4b86a485394ae
dovecot-mysql-debuginfo-2.3.8-4.el8.x86_64.rpm SHA-256: 2d8739bf872c5af7ca9f2e529fc1cb1e10ee5175b8e64aea2ef1f6ceae3c7f2e
dovecot-pgsql-2.3.8-4.el8.x86_64.rpm SHA-256: 633ec722205c8f14fa6bed9f68f03b144313f9f01e06b02ce8f2f374c27ed50a
dovecot-pgsql-debuginfo-2.3.8-4.el8.x86_64.rpm SHA-256: bd6576a755ecbade14679b269fd380bebc3185d7f95004b71881a6e5754ccd4d
dovecot-pigeonhole-2.3.8-4.el8.x86_64.rpm SHA-256: 3011955b23df70a417169809e40e250c1f1321d78f3a4912c0698b650700c2ae
dovecot-pigeonhole-debuginfo-2.3.8-4.el8.x86_64.rpm SHA-256: fcc1789046eed054a7581a9d42cc94050ba6df6b4bf8bc800752ce9c79a287b9

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
dovecot-2.3.8-4.el8.src.rpm SHA-256: f3f6fe98b9b3ae611fb2637bdb34d8ec38d6511bbf0e69758783a979c64e6e4d
s390x
dovecot-2.3.8-4.el8.s390x.rpm SHA-256: 58283c73c44bfe1fa193eb621c63c2cb0ab54a1c37abe64f343664e84fd61392
dovecot-debuginfo-2.3.8-4.el8.s390x.rpm SHA-256: a0285f0309b7ad33a8c0728487591367eaba835d50a10bc6fdabc2601323f558
dovecot-debugsource-2.3.8-4.el8.s390x.rpm SHA-256: 420d567e79801a9a9ea99e354ba23ea771e8549987822ba4abe0ab489b3bb13c
dovecot-mysql-2.3.8-4.el8.s390x.rpm SHA-256: aff52825a4caa68eea16149a4c2b9baf7cc9dba5c89ef1174a2987d34ceb30f2
dovecot-mysql-debuginfo-2.3.8-4.el8.s390x.rpm SHA-256: 19f4a015fd3c7cfa735ef2cc28a69b6c3c06ce2dab7b7b618fb9c4699f4a5929
dovecot-pgsql-2.3.8-4.el8.s390x.rpm SHA-256: d38bdbb55764e7d50cc6999329d7b12947013614b457bac9d92cf63238aa8229
dovecot-pgsql-debuginfo-2.3.8-4.el8.s390x.rpm SHA-256: 13361022082d61b937801b35e9ab47f554d4b0cb5c39d76c1e34e6ca384ac41b
dovecot-pigeonhole-2.3.8-4.el8.s390x.rpm SHA-256: 751a34f56973e806a80958564d4815abd489601eb7e3b2574976e9c2dc4437e9
dovecot-pigeonhole-debuginfo-2.3.8-4.el8.s390x.rpm SHA-256: e34d1380244dc30b5c69a731d5f86d8847d3e8e68299c1325f7e076d7abbaf25

Red Hat Enterprise Linux for Power, little endian 8

SRPM
dovecot-2.3.8-4.el8.src.rpm SHA-256: f3f6fe98b9b3ae611fb2637bdb34d8ec38d6511bbf0e69758783a979c64e6e4d
ppc64le
dovecot-2.3.8-4.el8.ppc64le.rpm SHA-256: 515a661cc5e7951fc13cffc38c54e8ffa1351b06eeff7f634e8e60e3c47c670b
dovecot-debuginfo-2.3.8-4.el8.ppc64le.rpm SHA-256: d3c12b90c28d761fb4c9f9d08c13ab76b5acb5990d8a59ed6a8814d629d1917a
dovecot-debugsource-2.3.8-4.el8.ppc64le.rpm SHA-256: 0b5c65f95668a0feeb7927b23bc34a74ed22af43a5204b65a747a00cd11c16ba
dovecot-mysql-2.3.8-4.el8.ppc64le.rpm SHA-256: 95ad988da7161f01894ace036114eb420969a9bfc4435dffd28ee3aa9e42eb3a
dovecot-mysql-debuginfo-2.3.8-4.el8.ppc64le.rpm SHA-256: 1a3bca7569337260de47c24bbd1ed8289f1fca4b6d77a0f05572265578c12786
dovecot-pgsql-2.3.8-4.el8.ppc64le.rpm SHA-256: afa23658693a51117a71d94a75068710a099d3c34fdc2a22c02e721a45299c42
dovecot-pgsql-debuginfo-2.3.8-4.el8.ppc64le.rpm SHA-256: 822e7346ef75a8f5cc8b86f9689eaf936bc3da4bf535ff83e2bdeb9b0b9ba99e
dovecot-pigeonhole-2.3.8-4.el8.ppc64le.rpm SHA-256: 0b5f5cbd69dbb3ebf6637243b18692b871cb735d4349e428219ed3337ad4a3dd
dovecot-pigeonhole-debuginfo-2.3.8-4.el8.ppc64le.rpm SHA-256: 60c15f319da733405ba573b036284dfd284171fe0db6cf123d155a02043889b4

Red Hat Enterprise Linux for ARM 64 8

SRPM
dovecot-2.3.8-4.el8.src.rpm SHA-256: f3f6fe98b9b3ae611fb2637bdb34d8ec38d6511bbf0e69758783a979c64e6e4d
aarch64
dovecot-2.3.8-4.el8.aarch64.rpm SHA-256: 80e4b3a57470ba4ea4ebc4d507cc95e67b1350e1252726d296d02839e955ddb4
dovecot-debuginfo-2.3.8-4.el8.aarch64.rpm SHA-256: e78064b4afbc79f17194985ed8e4a52e618da43035460f2c465a66a706fbdeb9
dovecot-debugsource-2.3.8-4.el8.aarch64.rpm SHA-256: b8108ed6545306eb32b8366c8b56349e8eea5d0c0b33db71aa8d880f396eb392
dovecot-mysql-2.3.8-4.el8.aarch64.rpm SHA-256: 80afa7cac143e812212ae48035dbb9c5e97e48a00862b607027106d020ed6239
dovecot-mysql-debuginfo-2.3.8-4.el8.aarch64.rpm SHA-256: 1964c109c516a6a8dc3c7aed97d5b070a82e813a1c9956107f34271f7713b049
dovecot-pgsql-2.3.8-4.el8.aarch64.rpm SHA-256: 08c7a2a84c600e75e47a6ea91ae21b2d79add47d022c4b4d12adf181dc3d31b3
dovecot-pgsql-debuginfo-2.3.8-4.el8.aarch64.rpm SHA-256: 37cf980d31d104897a837969d0af9c12b24dcf63c86b13742d2a8077876abed4
dovecot-pigeonhole-2.3.8-4.el8.aarch64.rpm SHA-256: 8a0c6fc1744f8e74160a7c3e15544f2365a021f399ce1c9237e7f91f30a5de6b
dovecot-pigeonhole-debuginfo-2.3.8-4.el8.aarch64.rpm SHA-256: c7f92b8a140e12651021a1a2cfe2e323e367ef8111b037533295233290c55e07

Red Hat CodeReady Linux Builder for x86_64 8

SRPM
x86_64
dovecot-2.3.8-4.el8.i686.rpm SHA-256: 6568af2cd9935952728faa0d1d2cd39c23cad106c16f229c5b1809d17f7c51b2
dovecot-debuginfo-2.3.8-4.el8.i686.rpm SHA-256: be5cc4fbd31618f7f6eb3ef5deb19782517ba1c7bb763d959ba88e3d89af0a15
dovecot-debuginfo-2.3.8-4.el8.x86_64.rpm SHA-256: 37161f3bf8e0d6f7fb705029ad50d18a4056013857ac216172d20547d5bbaf92
dovecot-debugsource-2.3.8-4.el8.i686.rpm SHA-256: fef698e56bf0e954e26fcf6d3646b604defd69c9a7aaf62914b98771ba4060b4
dovecot-debugsource-2.3.8-4.el8.x86_64.rpm SHA-256: aa3890d55c940a33004c8f8ffc7ea91c6eb95ef0eded85eba13a059b5f64ec60
dovecot-devel-2.3.8-4.el8.i686.rpm SHA-256: a11df39aa67c41824d06fcf60446ae537d93c10d3f3eb33bea30131160b7b255
dovecot-devel-2.3.8-4.el8.x86_64.rpm SHA-256: 1f8866f70b51288efe4b8a26663fcc470519950f049509d0888e9074b9e4ef09
dovecot-mysql-debuginfo-2.3.8-4.el8.i686.rpm SHA-256: 3831faf5a6501280d9ad72aad1aa873850fd69dabdd8f4b9a862b695d0f1b299
dovecot-mysql-debuginfo-2.3.8-4.el8.x86_64.rpm SHA-256: 2d8739bf872c5af7ca9f2e529fc1cb1e10ee5175b8e64aea2ef1f6ceae3c7f2e
dovecot-pgsql-debuginfo-2.3.8-4.el8.i686.rpm SHA-256: 070799cbb98725bf096e8e7bf729f20dcb04662216ad2faf406101d06f3a0cf1
dovecot-pgsql-debuginfo-2.3.8-4.el8.x86_64.rpm SHA-256: bd6576a755ecbade14679b269fd380bebc3185d7f95004b71881a6e5754ccd4d
dovecot-pigeonhole-debuginfo-2.3.8-4.el8.i686.rpm SHA-256: c950de980f21cf6eda736bd792cb12596a9e3806cb9afaa0a4b2aa5cdb51bf2c
dovecot-pigeonhole-debuginfo-2.3.8-4.el8.x86_64.rpm SHA-256: fcc1789046eed054a7581a9d42cc94050ba6df6b4bf8bc800752ce9c79a287b9

Red Hat CodeReady Linux Builder for Power, little endian 8

SRPM
ppc64le
dovecot-debuginfo-2.3.8-4.el8.ppc64le.rpm SHA-256: d3c12b90c28d761fb4c9f9d08c13ab76b5acb5990d8a59ed6a8814d629d1917a
dovecot-debugsource-2.3.8-4.el8.ppc64le.rpm SHA-256: 0b5c65f95668a0feeb7927b23bc34a74ed22af43a5204b65a747a00cd11c16ba
dovecot-devel-2.3.8-4.el8.ppc64le.rpm SHA-256: aa190ca6814af6ca535c5fe7188e492724323033cff8e03564985ccfe347211c
dovecot-mysql-debuginfo-2.3.8-4.el8.ppc64le.rpm SHA-256: 1a3bca7569337260de47c24bbd1ed8289f1fca4b6d77a0f05572265578c12786
dovecot-pgsql-debuginfo-2.3.8-4.el8.ppc64le.rpm SHA-256: 822e7346ef75a8f5cc8b86f9689eaf936bc3da4bf535ff83e2bdeb9b0b9ba99e
dovecot-pigeonhole-debuginfo-2.3.8-4.el8.ppc64le.rpm SHA-256: 60c15f319da733405ba573b036284dfd284171fe0db6cf123d155a02043889b4

Red Hat CodeReady Linux Builder for ARM 64 8

SRPM
aarch64
dovecot-debuginfo-2.3.8-4.el8.aarch64.rpm SHA-256: e78064b4afbc79f17194985ed8e4a52e618da43035460f2c465a66a706fbdeb9
dovecot-debugsource-2.3.8-4.el8.aarch64.rpm SHA-256: b8108ed6545306eb32b8366c8b56349e8eea5d0c0b33db71aa8d880f396eb392
dovecot-devel-2.3.8-4.el8.aarch64.rpm SHA-256: 28959fe45f54193df9667f97da2bbaacd3d3b8e64ca907d8750104bb7f25a023
dovecot-mysql-debuginfo-2.3.8-4.el8.aarch64.rpm SHA-256: 1964c109c516a6a8dc3c7aed97d5b070a82e813a1c9956107f34271f7713b049
dovecot-pgsql-debuginfo-2.3.8-4.el8.aarch64.rpm SHA-256: 37cf980d31d104897a837969d0af9c12b24dcf63c86b13742d2a8077876abed4
dovecot-pigeonhole-debuginfo-2.3.8-4.el8.aarch64.rpm SHA-256: c7f92b8a140e12651021a1a2cfe2e323e367ef8111b037533295233290c55e07

Red Hat CodeReady Linux Builder for IBM z Systems 8

SRPM
s390x
dovecot-debuginfo-2.3.8-4.el8.s390x.rpm SHA-256: a0285f0309b7ad33a8c0728487591367eaba835d50a10bc6fdabc2601323f558
dovecot-debugsource-2.3.8-4.el8.s390x.rpm SHA-256: 420d567e79801a9a9ea99e354ba23ea771e8549987822ba4abe0ab489b3bb13c
dovecot-devel-2.3.8-4.el8.s390x.rpm SHA-256: 048c49c3ae034e8cfbebace0bbaa0b133ea8fc69f409706894c0b459ce43a16c
dovecot-mysql-debuginfo-2.3.8-4.el8.s390x.rpm SHA-256: 19f4a015fd3c7cfa735ef2cc28a69b6c3c06ce2dab7b7b618fb9c4699f4a5929
dovecot-pgsql-debuginfo-2.3.8-4.el8.s390x.rpm SHA-256: 13361022082d61b937801b35e9ab47f554d4b0cb5c39d76c1e34e6ca384ac41b
dovecot-pigeonhole-debuginfo-2.3.8-4.el8.s390x.rpm SHA-256: e34d1380244dc30b5c69a731d5f86d8847d3e8e68299c1325f7e076d7abbaf25

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.