CVE-2020-10957

2020-05-1814:15:11

Google

osv.dev

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.8 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.007 Low

EPSS

Percentile

79.4%

JSON

In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.

CPENameOperatorVersion
dovecoteq2.3.5.1-r3
dovecoteq1.2.6-r0
dovecoteq2.2.19-r0
dovecoteq2.3.9.3-r3
dovecoteq2.3.10-r3
dovecoteq2.0.10-r0
dovecoteq2.2.33.2-r1
dovecoteq2.3.9-r0
dovecoteq2.2.33.2-r2
dovecoteq2.3.4.1-r1

Name	Operator	Version
dovecot	eq	2.3.5.1-r3
dovecot	eq	1.2.6-r0
dovecot	eq	2.2.19-r0
dovecot	eq	2.3.9.3-r3
dovecot	eq	2.3.10-r3
dovecot	eq	2.0.10-r0
dovecot	eq	2.2.33.2-r1
dovecot	eq	2.3.9-r0
dovecot	eq	2.2.33.2-r2
dovecot	eq	2.3.4.1-r1