CVE-2020-10957
dovecot: malformed NOOP commands leads to DoS
Severity Score
Exploit Likelihood
Affected Versions
1Public Exploits
2Exploited in Wild
-Decision
Descriptions
In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.
En Dovecot versiones anteriores a 2.3.10.1, el envío no autenticado de parámetros malformados hacia un comando NOOP causa una Desreferencia del Puntero NULL y un bloqueo en submission-login o lmtp.
A flaw was found in Dovecot, where it did not properly handle certain malformed NOOP commands. This flaw allows a malicious attacker to cause the submission, submission-login, or lmtp services to crash by sending specially crafted commands.
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Issues addressed include a denial of service vulnerability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-03-25 CVE Reserved
- 2020-05-18 CVE Published
- 2020-05-19 First Exploit
- 2024-08-04 CVE Updated
- 2025-04-05 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-400: Uncontrolled Resource Consumption
- CWE-476: NULL Pointer Dereference
CAPEC
References (13)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/157771/Open-Xchange-Dovecot-2.3.10-Null-Pointer-Derefer... | X_refsource_misc |
|
| http://www.openwall.com/lists/oss-security/2020/05/18/1 | Mailing List |
|
| https://www.openwall.com/lists/oss-security/2020/05/18/1 | Mailing List |
|
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/157771 | 2020-05-19 | |
| http://seclists.org/fulldisclosure/2020/May/37 | 2024-08-04 |
| URL | Date | SRC |
|---|