Vulnerability Name:

CVE-2020-24386 (CCN-194123)

Assigned:2020-08-19
Published:2021-01-04
Updated:2022-09-02
Summary:An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).
CVSS v3 Severity:6.8 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
5.9 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
8.2 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N)
7.1 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
6.8 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
5.9 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:4.9 Medium (CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
6.6 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-Other
CWE-138
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2020-24386

Source: MISC
Type: Mailing List, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/160842/Dovecot-2.3.11.3-Access-Bypass.html

Source: FULLDISC
Type: Mailing List, Third Party Advisory
20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail

Source: CONFIRM
Type: Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/01/04/4

Source: MISC
Type: Vendor Advisory
https://doc.dovecot.org/configuration_manual/hibernation/

Source: CONFIRM
Type: Mailing List, Vendor Advisory
https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html

Source: MISC
Type: Vendor Advisory
https://dovecot.org/security

Source: XF
Type: UNKNOWN
oxsoftware-cve202024386-info-disc(194123)

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-c90cb486f7

Source: CCN
Type: oss-sec Mailing List, Mon, 4 Jan 2021 14:03:22 +0200
CVE-2020-24386: Dovecot: IMAP hibernation allows accessing other peoples mail

Source: GENTOO
Type: Third Party Advisory
GLSA-202101-01

Source: DEBIAN
Type: Third Party Advisory
DSA-4825

Source: CCN
Type: OX Software Web site
Dovecot

Vulnerable Configuration:Configuration 1:
  • cpe:/a:dovecot:dovecot:*:*:*:*:*:*:*:* (Version >= 2.2.26 and < 2.3.13)

    • Configuration 2:
  • cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:fedoraproject:fedora:32:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:7908
    P
    		libIlmImf-2_2-23-2.2.1-3.41.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:7982
    P
    		wavpack-5.4.0-150000.4.15.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:51566
    P
    		Security update for containerized-data-importer (Important)
    2022-11-23
    oval:org.opensuse.security:def:3473
    P
    		dnsmasq-2.78-18.9.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:95103
    P
    		dovecot23-2.3.15-58.3 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:112172
    P
    		dovecot23-2.3.16-1.6 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:105704
    P
    		dovecot23-2.3.16-1.6 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:2235
    P
    		dovecot23-2.3.11.3-17.5.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63324
    P
    		dovecot23-2.3.11.3-17.5.1 on GA media (Moderate)
    2021-08-10
    oval:com.redhat.rhsa:def:20211887
    P
    		RHSA-2021:1887: dovecot security and bug fix update (Moderate)
    2021-05-18
    oval:org.opensuse.security:def:110668
    P
    		Security update for dovecot23 (Important)
    2021-01-16
    oval:org.opensuse.security:def:111210
    P
    		Security update for dovecot23 (Important)
    2021-01-07
    oval:org.opensuse.security:def:69071
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:96063
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:9392
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:69532
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:105431
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:97166
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:98741
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:10146
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:70286
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:109419
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:97168
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:102753
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:68997
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:118515
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:91791
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:97170
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:8646
    P
    		Security update for dovecot23 (Important)
    2021-01-05
    oval:org.opensuse.security:def:32930
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:82575
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:26061
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:57921
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:125540
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:89392
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:85643
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:31179
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:23155
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:60268
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:55828
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:88124
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:33656
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:83212
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:28917
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:58753
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:126710
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:51895
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:86090
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:31626
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:81077
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:23578
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:57002
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:5048
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:88437
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:33914
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:84146
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:29368
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:59479
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:127107
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:54740
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:86562
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:32098
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:82124
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:23907
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:57449
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:51143
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:89134
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:34445
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:84604
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:30005
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:21395
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:59737
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:55191
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:87394
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    BACK
    dovecot dovecot *
    debian debian linux 10.0
    fedoraproject fedora 32