PT-2020-19354 · Dovecot+1 · Dovecot+1

Michal Hlavinka · Published 2020-02-12 · Updated 2025-01-30 · CVE-2020-7046

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Dovecot versions 2.3.9 through 2.3.9.2

Description The issue is related to the mishandling of truncated UTF-8 data in command parameters by lib-smtp in submission-login and lmtp. This can be demonstrated by the unauthenticated triggering of a submission-login infinite loop.

Recommendations For Dovecot versions 2.3.9 through 2.3.9.2, update to version 2.3.9.3 or later to resolve the issue.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALT-PU-2020-1984

CVE-2020-7046

OPENSUSE-SU-2024:10726-1

OPENSUSE-SU-2025:14715-1

Affected Products

Alt Linux

Dovecot

References · 37

• https://dovecot.org/security · Vendor Advisory
• https://dovecot.org/pipermail/dovecot-news/2020-February/000431.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7046 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XYT55WH372BJOXCJRKBDIFGBMPVOIDT · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJXHOUT3FH2DJNMACSX4GHPP4MUV4UKA · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10726-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-7046 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14715-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7046 · Security Note
• https://suse.com/security/cve/CVE-2020-10958 · Note
• https://security.alpinelinux.org/vuln/CVE-2020-7046 · Note
• http://openwall.com/lists/oss-security/2020/02/12/1 · Note
• https://suse.com/security/cve/CVE-2017-15132 · Note
• https://suse.com/security/cve/CVE-2020-12674 · Note
• https://suse.com/security/cve/CVE-2020-12100 · Note