CVE-2020-10958 Use after free in n/a
An unauthenticated attacker can crash the Dovecot submission or LMTP services by sending a crafted message with many newlines.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-10958?
CVE-2020-10958 is a medium-severity use after free vulnerability in Dovecot Dovecot, published on 18 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command.
Weakness: CWE-416
Which versions are affected by CVE-2020-10958?
It affects 1 product.
Products include Dovecot Dovecot.
How do I fix CVE-2020-10958?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2020-10958 being exploited?
There is no known exploitation of CVE-2020-10958 in the wild and no public exploit code.
Other vulnerabilities in Dovecot Dovecot
Sources
Also known as ALPINE-CVE-2020-10958, DEBIAN-CVE-2020-10958, GHSA-v4pj-8r82-6phx, UBUNTU-CVE-2020-10958.