Package: src:dovecot Version: 1:2.3.10.1+dfsg1-2 Severity: grave Tags: security bullseye sid Justification: user security hole
Multiple security issues have been identified in dovecot. These were addressed in stable with dovecot 1:2.3.4.1-5+deb10u3 (DSA 4745-1), but need to be tracked in unstable and testing. >From the DSA: CVE-2020-12100 Receiving mail with deeply nested MIME parts leads to resource exhaustion as Dovecot attempts to parse it. CVE-2020-12673 Dovecot's NTLM implementation does not correctly check message buffer size, which leads to a crash when reading past allocation. CVE-2020-12674 Dovecot's RPA mechanism implementation accepts zero-length message, which leads to assert-crash later on.