CVE-2020-12674

Published: 12 August 2020

In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled.

Notes

marking precise as ignored since we won't fix it
version in that release is quite old and the backports
could possibly cause serious regressions.

Priority

Medium

CVSS 3 base score: 7.5

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12674
• https://ubuntu.com/security/notices/USN-4456-1
• https://ubuntu.com/security/notices/USN-4456-2
• NVD
• Launchpad
• Debian