CVE-2020-24386

2021-01-0400:00:00

ubuntu.com

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.9 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

0.004 Low

EPSS

Percentile

72.9%

JSON

An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an
authenticated attacker can trigger unhibernation via attacker-controlled
parameters, leading to access to other users’ email messages (and path
disclosure).

Notes

Author	Note
mdeslaur	per upstream, Vulnerable version: 2.2.26-2.3.11.3

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchdovecot< 1:2.2.33.2-1ubuntu4.7UNKNOWN
ubuntu20.04noarchdovecot< 1:2.3.7.2-1ubuntu3.3UNKNOWN
ubuntu20.10noarchdovecot< 1:2.3.11.3+dfsg1-2ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	dovecot	< 1:2.2.33.2-1ubuntu4.7	UNKNOWN
ubuntu	20.04	noarch	dovecot	< 1:2.3.7.2-1ubuntu3.3	UNKNOWN
ubuntu	20.10	noarch	dovecot	< 1:2.3.11.3+dfsg1-2ubuntu0.1	UNKNOWN