Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 28 Jun 2021 10:02:07 +0300 (EEST)
From: Aki Tuomi <>
To: "" <>
Subject: CVE-2020-28200: Dovecot Pigeonhole Sieve excessive resource usage

Open-Xchange Security Advisory 2021-06-28

Affected product: Dovecot IMAP Server
Vendor: OX Software GmbH

Internal reference: DOV-4159 
Vulnerability type: Uncontrolled Resource Consumption (CWE-400)
Vulnerable version: ancient
Vulnerable component: sieve
Report confidence: Confirmed
Solution status: Fix available
Researcher credits: Innokentii Sennovskii from BI.ZONE (rumata)
Vendor notification: 2020-09-23
CVE reference: CVE-2020-28200
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

Vulnerability Details:
Sieve interpreter is not protected against abusive scripts that claim excessive resource usage.
Fixed by limiting both the CPU system+user time per single script execution and cumulatively over
several script runs within a configurable timeout period. Sufficiently large CPU time usage is
summed in the Sieve script binary and execution is blocked when the sum exceeds the limit within that time.
The block is lifted when the script is updated after the resource usage times out.

Attacker can cause uncontrolled CPU resource consumption to cause partial or complete denial of service.

Steps to reproduce:
Use sufficiently CPU intensive regular expression.

Install patched version of Dovecot

Disable sieve "regex" extension.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.