VulnerabilityModified
CVE-2020-7957
This causes a denial of service in which the recipient cannot read all of their messages.
MEDIUM 5.3EPSS 1.88%
Does this matter?
Lower severity and a low EPSS score (1.88%). Track it; it rarely justifies an emergency change on its own.
Description
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. This causes a denial of service in which the recipient cannot read all of their messages.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- EPSS
- 1.88% probability · 78th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- dovecot/dovecot · fedoraproject/fedora
- Source
- cve@mitre.org
References
- http://www.openwall.com/lists/oss-security/2020/02/12/2Exploit, Mailing List, Third Party Advisory
- https://dovecot.org/pipermail/dovecot-news/2020-February/000430.htmlExploit, Mailing List, Vendor Advisory
- https://dovecot.org/securityVendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XYT55WH372BJOXCJRKBDIFGBMPVOIDT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJXHOUT3FH2DJNMACSX4GHPP4MUV4UKA/
- http://www.openwall.com/lists/oss-security/2020/02/12/2Exploit, Mailing List, Third Party Advisory
- https://dovecot.org/pipermail/dovecot-news/2020-February/000430.htmlExploit, Mailing List, Vendor Advisory
- https://dovecot.org/securityVendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XYT55WH372BJOXCJRKBDIFGBMPVOIDT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJXHOUT3FH2DJNMACSX4GHPP4MUV4UKA/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.