CVE-2020-12100

Vulnerability

Dovecot versions before 2.3.11.3 contain an uncontrolled recursion vulnerability (CWE-674) in the submission, lmtp, and lda components. When processing a crafted e-mail message with deeply nested MIME parts, the parser enters infinite recursion, leading to resource exhaustion. The issue affects Dovecot 2.0 through 2.3.11.2 [2].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted e-mail message with deeply nested MIME parts to a Dovecot server. No authentication or prior access is required; the attacker only needs network connectivity to the server's SMTP or LMTP submission port. The message triggers uncontrolled recursion during MIME parsing, consuming CPU and memory resources [2].

Impact

Successful exploitation causes a denial of service (DoS) condition. The Dovecot process handling the message becomes unresponsive or crashes, disrupting mail delivery for legitimate users. The CVSS score is 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high availability impact with no confidentiality or integrity loss [2].

Mitigation

The vulnerability is fixed in Dovecot version 2.3.11.3, released on 2020-08-12. Administrators should upgrade to this version or later. No workarounds are documented; upgrading is the only mitigation. Note that the fix for this CVE introduced a related issue (CVE-2020-25275) which was subsequently addressed in 2.3.13 [1].