• Introducing WebPros Cloud - a fully managed infrastructure platform purpose-built to simplify the deployment of WebPros products !  WebPros Cloud enables you to easily deliver WebPros solutions — without the complexity of managing the infrastructure.
    Join the pilot program today!
  • The Horde component is removed from Plesk Installer. We recommend switching to another webmail software supported in Plesk.
  • The BIND DNS server has already been deprecated and removed from Plesk for Windows.
    If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS. We strongly recommend transitioning to Microsoft DNS within the next 6 weeks, before the Plesk 18.0.70 release.

Question Dovecot CVE-2020-12100

The two or three bugs fixed with that update only cause issues under specific circumstances which are not in place in a standard installation and usage.
 
Affected product: Dovecot IMAP server
Internal reference: DOP-1849 (Bug ID)
Vulnerability type: Uncontrolled recursion (CWE-674)
Vulnerable version: 2.0
Vulnerable component: submission, lmtp, lda
Fixed version: 2.3.11.3
Report confidence: Confirmed
Solution status: Fix available
Vendor notification: 2020-04-23
CVE reference: CVE-2020-12100
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Vulnerability Details:
Receiving mail with deeply nested MIME parts leads to resource
exhaustion as Dovecot attempts to
parse it.

Risk:
Malicious actor can cause denial of service to mail delivery by
repeatedly sending mails with bad
content.

Workaround:
Limit MIME structures in MTA.

Solution:
Upgrade to fixed version.
 
While that is true, actually the MTA (your smtp server) should already protect you from such mails.
 
All mail is processed through your local MTA. As far as I have read, Postfix limits the number of MIME parts to 100 by default. This can be controlled by the MIME nesting parameter as described in

So it should not be possible to get a mail processed that has more than a hundred in the first place. I'll be rejected before it is processed by Dovecot.
 
Back
Top