Security Advisories & Policy
Dovecot was designed since the beginning with security in mind and with many ways to provide privilege separation. Although the code is written with C, it’s a Dovecot-hardened special C variant that makes it much more difficult to write security holes than with most other C-based projects.
Found a Security Bug?
Do not report security issues via public mailing lists or public issues tracker. Please report vulnerabilities confidentially using our GPG encrypted mailbox at security@dovecot.org or via our YesWeHack Bug Bounty Program.
General Bug Reporting
For non-security related bugs, technical defects, or configuration issues, please consult the guidelines before submitting.
Security Advisories
Invalid base64 authentication can cause DoS for other logins. When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail.
decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing. Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments.
v2.4/v3.1 regression: Pigeonhole: ManageSieve panic occurs with sieve-connect as a client. ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response.
auth: Path traversal in passwd-file passdb using %d (domain) escapes base directory and opens /etc/passwdPre-auth path traversal in passwd-file passdb using %d (domain) escapes base directory and opens /etc/passwd. When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal can happen if the domain component is directory partial. Fixed in v2.4.0.
v2.4/v3.1 regression: SQL injection allows bypassing authentication. Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin.
auth: OTP driver vulnerable to replay attack. Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid.
doveadm: Credentials verified without timing safety. Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials.
imap-login: Excessive memory usage DoS. Sending `NOOP (((...)))` command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections.
managesieve-login out-of-memory DoS. Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.
v3.0.2+ regression: Message headers MIME parameter parsing can cause excessive CPU usage. A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU.
v2.4/v3.1 regression: auth-ldap is not escaping usernames. If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication.
Using auth caching with oauth2 passdb, passwd passdb or userdb, or passwd userdb, causes the first lookup to be cached for all the lookups.
Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive
Very large headers can cause resource exhaustion when parsing message
Privilege escalation possible in dovecot when similar master and non-master passdbs are used
oauth2 JWT local validation path traversal
SMTP Submission service STARTTLS injection
IMAP hibernation allows accessing other peoples mail
MIME parsing crashes with particular messages
Receiving mail with deeply nested MIME parts leads to resource exhaustion
Specially crafted NTLM package can crash auth service
Specially crafted RPA authentication message crashes auth
Sending malformed NOOP command causes crash in submission, submission-login or lmtp service.
Sending command followed by sufficient number of newlines triggers a use-after-free bug that might crash submission-login, submission or lmtp service.
Sending mail with empty quoted localpart causes submission or lmtp component to crash.
Truncated UTF-8 can be used to DoS submission-login and lmtp processes
Specially crafted mail can crash snippet generation
IMAP and ManageSieve protocol parsers do not properly handle NUL byte when scanning data in quoted strings
Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting
Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent
JSON encoder in Dovecot 2.3 incorrectly assert-crashes when encountering invalid UTF-8 characters
Buffer overflow when reading extension header from dovecot index files
Suitable client certificate can be used to login as other user