VYPR
← All advisories
Unrated severityNVD Advisory· Published Aug 12, 2020· Updated Aug 4, 2024

CVE-2020-12674

CVE-2020-12674

Description

A specially crafted RPA authentication request with zero-length message crashes Dovecot auth service, causing denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A specially crafted RPA authentication request with zero-length message crashes Dovecot auth service, causing denial of service.

Vulnerability

In Dovecot versions before 2.3.11.3, the RPA (Remote Passphrase Authentication) mechanism fails to properly handle zero-length messages. When a zero-length message is received, the code mishandles the length, leading to a buffer over-read (CWE-126) and an assertion failure that crashes the auth service. This affects Dovecot 2.2.x and possibly earlier versions, as indicated in reference [2]. The vulnerability was fixed in version 2.3.11.3.

Exploitation

An unauthenticated remote attacker can send a specially crafted RPA authentication request containing a zero-length message to the Dovecot server. The attacker does not need any prior authentication or special network position; only network access to the Dovecot service is required. Upon receiving the malformed request, the auth process crashes due to the assertion failure, resulting in a denial of service.

Impact

Successful exploitation leads to a crash of the Dovecot auth service. Repeated crashes can prevent legitimate users from authenticating, effectively denying access to email services. The impact is limited to availability (denial of service); there is no confidentiality or integrity compromise [1][2].

Mitigation

The vulnerability is fixed in Dovecot version 2.3.11.3, which was released on 2020-08-12. Users should upgrade to this version or later. Distributions such as Ubuntu have provided updated packages via USN-4456-1 [1]. No workarounds are documented, and the CVE is not listed on the KEV (Known Exploited Vulnerabilities) catalog.

References
  1. USN-4456-1: Dovecot vulnerabilities | Ubuntu security notices | Ubuntu
  2. security - CVE-2020-12674: Dovecot IMAP server: Specially crafted RPA authentication message crashes auth

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

30

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Dovecot's RPA mechanism implementation accepts a zero-length message, which is mishandled and causes an assert-crash in the auth service."

Attack vector

An unauthenticated remote attacker sends a specially formatted RPA authentication request containing a zero-length message. The RPA mechanism implementation mishandles this zero length, leading to an assert-crash in the auth process [ref_id=1]. The attack is network-based, requires no privileges, and can be delivered over IMAP or POP3 (the reproduction uses port 110) [ref_id=1]. By repeatedly sending such requests, an adversary can prevent legitimate logins.

Affected code

The vulnerable component is the auth service in Dovecot's RPA mechanism implementation. The advisory notes the vulnerable version is 2.2 and the fixed version is 2.3.11.3 [ref_id=1]. The patch is not included in the bundle, so the exact function or file path is not specified.

What the fix does

The advisory states the fix is available in Dovecot version 2.3.11.3 [ref_id=1]. No patch diff is provided in the bundle, so the exact code change is unknown. The advisory recommends upgrading to the fixed version or, as a workaround, disabling RPA authentication entirely [ref_id=1].

Preconditions

  • configThe Dovecot server must have the RPA authentication mechanism enabled (default in some configurations)
  • authNo authentication or prior session is required
  • networkAttacker must be able to reach the Dovecot auth service over the network (e.g., IMAP or POP3 ports)
  • inputAttacker sends a crafted RPA request with a zero-length message field

Reproduction

The advisory includes a reproduction command: `(echo 'AUTH RPA'; echo -ne '\x60\x11\x06\x09\x60\x86\x48\x01\x86\xf8\x73\x01\x01\x01\x00\x04\x00\x00\x01' | base64 -w 0; echo ; echo -ne '\x60\x11\x06\x09\x60\x86\x48\x01\x86\xf8\x73\x01\x01\x00\x03A@A\x00' | base64 -w 0; echo ; echo QUIT) | nc 127.0.0.1 110` [ref_id=1]. This sends a specially formatted RPA authentication request over POP3 to crash the auth process.

Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

12

News mentions

0

No linked articles in our index yet.