PT-2020-6941 · Dovecot+7 · Dovecot+7

Aki Tuomi · Published 2020-08-17 · Updated 2025-01-30 · CVE-2020-24386

Positive Technologies (AI Summary)

CVSS v2.0

7.9

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.3.13

Description The issue is related to the improper neutralization of control and meta characters in the Dovecot mail server, allowing a remote attacker to access and compromise confidential data. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages and path disclosure.

Recommendations For versions prior to 2.3.13, update to version 2.3.13 or later to resolve the issue. As a temporary workaround, consider restricting access to IMAP IDLE functionality until a patch is applied. Avoid using attacker-controlled parameters in IMAP IDLE to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-150

Related Identifiers

ALSA-2021:1887

ALT-PU-2021-1027

ALT-PU-2021-1055

ALT-PU-2021-1205

BDU:2023-07818

CESA-2021_1887

CVE-2020-24386

DLA-2517-1

DSA-4825-1

MGASA-2021-0008

OESA-2021-1042

OPENSUSE-SU-2021:0026-1

OPENSUSE-SU-2021:0072-1

OPENSUSE-SU-2021_0026-1

OPENSUSE-SU-2021_0072-1

OPENSUSE-SU-2024:10726-1

OPENSUSE-SU-2025:14715-1

RHSA-2021:1887

RHSA-2021_1887

SUSE-SU-2021:0018-1

SUSE-SU-2021:0027-1

SUSE-SU-2021:0028-1

SUSE-SU-2021:0029-1

SUSE-SU-2021_0018-1

USN-4674-1

Affected Products

Alt Linux

Almalinux

Centos

Dovecot

Linuxmint

Red Hat

Suse

Ubuntu

References · 90

• https://bdu.fstec.ru/vul/2023-07818 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-24386 · Vendor Advisory
• https://dovecot.org/security · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-1887.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24386 · Security Note
• https://ubuntu.com/security/CVE-2020-25275 · Vendor Advisory
• https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0018-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4674-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-24386 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25275 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24386 · Vendor Advisory
• https://debian.org/security/2021/dsa-4825 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0072-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-24386 · Vendor Advisory