The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1225-1 advisory.

  - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a     situation with a complex regular expression for the regex extension. (CVE-2020-28200)

  - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick     OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs     during use of local JWT validation with the posix fs driver. (CVE-2021-29157)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2891-1 advisory.

  - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a     situation with a complex regular expression for the regex extension. (CVE-2020-28200)

  - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick     OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs     during use of local JWT validation with the posix fs driver. (CVE-2021-29157)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2890-1 advisory.

  - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a     situation with a complex regular expression for the regex extension. (CVE-2020-28200)

  - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick     OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs     during use of local JWT validation with the posix fs driver. (CVE-2021-29157)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2892-1 advisory.

  - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a     situation with a complex regular expression for the regex extension. (CVE-2020-28200)

  - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick     OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs     during use of local JWT validation with the posix fs driver. (CVE-2021-29157)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2892-1 advisory.

  - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a     situation with a complex regular expression for the regex extension. (CVE-2020-28200)

  - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick     OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs     during use of local JWT validation with the posix fs driver. (CVE-2021-29157)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Dovecot team reports reports :

Sieve interpreter is not protected against abusive scripts that claim excessive resource usage. Fixed by limiting the user CPU time per single script execution and cumulatively over several script runs within a configurable timeout period. Sufficiently large CPU time usage is summed in the Sieve script binary and execution is blocked when the sum exceeds the limit within that time. The block is lifted when the script is updated after the resource usage times out.

ID	Name	Product	Family	Severity
153005	openSUSE 15 Security Update : dovecot23 (openSUSE-SU-2021:1225-1)	Nessus	SuSE Local Security Checks	medium
152947	SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2891-1)	Nessus	SuSE Local Security Checks	medium
152945	SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2890-1)	Nessus	SuSE Local Security Checks	medium
152944	SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2892-1)	Nessus	SuSE Local Security Checks	medium
152941	openSUSE 15 Security Update : dovecot23 (openSUSE-SU-2021:2892-1)	Nessus	SuSE Local Security Checks	medium
151001	FreeBSD : dovecot-pigeonhole -- Sieve excessive resource usage (f3fc2b50-d36a-11eb-a32c-00a0989e4ec1)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2020-28200

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium