VYPR
← All advisories
Unrated severityNVD Advisory· Published May 18, 2020· Updated Aug 4, 2024

CVE-2020-10967

CVE-2020-10967

Description

Remote unauthenticated attackers can crash Dovecot's lmtp or submission process by sending an email with an empty localpart, leading to denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Remote unauthenticated attackers can crash Dovecot's lmtp or submission process by sending an email with an empty localpart, leading to denial of service.

Vulnerability

Dovecot versions 2.3.0 through 2.3.10 are vulnerable to a NULL pointer dereference in the lmtp and submission processes [2]. When processing an email with an empty localpart (the part before the @ in an email address), the software fails to properly handle the NULL value, causing a crash. This affects the LMTP (Local Mail Transfer Protocol) and submission services.

Exploitation

An attacker can exploit this vulnerability remotely without authentication by sending a crafted email message with an empty localpart to a Dovecot server running the vulnerable version [2]. No special network position or user interaction is required; the attacker simply needs to deliver the malicious email to the server's lmtp or submission port.

Impact

Successful exploitation results in a denial of service (DoS) as the lmtp or submission process crashes [2][4]. This prevents legitimate mail delivery and submission until the process is restarted. The vulnerability does not lead to information disclosure or code execution; it is purely a denial of service.

Mitigation

The vulnerability is fixed in Dovecot version 2.3.10.1 [2]. Administrators should upgrade to this version or later. Ubuntu users can apply the update via package manager as per USN-4361-1 [4]. No workarounds are documented; upgrading is the recommended mitigation.

References
  1. security - Multiple vulnerabilities in Dovecot IMAP server
  2. USN-4361-1: Dovecot vulnerabilities | Ubuntu security notices | Ubuntu

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

12

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"NULL pointer dereference (CWE-476) when processing mail with an empty localpart in the submission or lmtp service."

Attack vector

A remote unauthenticated attacker can crash the lmtp or submission process by sending mail with an empty localpart [ref_id=1][ref_id=2]. The attack requires no authentication and is performed over the network against the submission or lmtp service ports. The advisory notes that for lmtp the risk is negligible because lmtp is usually behind a trusted MTA, but the submission-login service is directly exposed and can be kept down by repeated attacks [ref_id=1][ref_id=2].

Affected code

The vulnerability affects the submission and lmtp services in Dovecot versions 2.3.0 through 2.3.10 [ref_id=1][ref_id=2]. The advisory does not specify exact function or file paths, but identifies the vulnerable components as "submission, lmtp" [ref_id=1][ref_id=2].

What the fix does

The advisory states the fix is to upgrade to Dovecot version 2.3.10.1 [ref_id=1][ref_id=2]. No patch diff is included in the bundle, so the specific code changes are not visible. The vendor resolved the issue by properly handling input with an empty localpart to prevent the crash [ref_id=1][ref_id=2].

Preconditions

  • authNo authentication required
  • networkAttacker must be able to send mail to the submission or lmtp service port
  • inputMail must have an empty localpart

Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.