[Dovecot-news] CVE-2020-7046: Truncated UTF-8 can be used to DoS submission-login and lmtp processes

Aki Tuomi aki.tuomi at dovecot.fi
Wed Feb 12 14:05:39 EET 2020

Open-Xchange Security Advisory 2020-02-12

Affected product: Dovecot Core
Internal reference: DOV-3744 (JIRA ID)
Vulnerability type: Improper Input Validation (CWE-30)
Vulnerable version: 2.3.9
Vulnerable component: submission-login, lmtp
Fixed version:
Report confidence: Confirmed
Solution status: Fixed
Researcher credits: Open-Xchange oy
Vendor notification: 2020-01-14
CVE reference: CVE-2020-7046

Vulnerability Details:

lib-smtp doesn't handle truncated command parameters properly, resulting
in infinite loop taking 100% CPU for the process. This happens for LMTP
(where it doesn't matter so much) and also for submission-login where
unauthenticated users can trigger it.


Attacker can cause submission-login and lmtp processes to be exhausted,
leading into denial of service and CPU resource exhaustion.


Upgrade to

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <https://dovecot.org/pipermail/dovecot-news/attachments/20200212/6c31d24a/attachment.sig>

More information about the Dovecot-news mailing list