CVE-2020-10967: 
Dovecot vulnerability analysis and mitigation

CVE-2020-10967 affects Dovecot versions 2.3.0 through 2.3.10, where remote unauthenticated attackers can crash the LMTP or submission process by sending mail with an empty localpart. The vulnerability was discovered by mailbox.org, reported to the vendor on March 20, 2020, and publicly disclosed on May 18, 2020. The issue was fixed in Dovecot version 2.3.10.1 (Openwall List, Dovecot Security).

The vulnerability is classified as an improper input validation issue (CWE-20) with a CVSS v3.1 score of 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The vulnerability occurs when sending mail with an empty quoted localpart in the email address format <""@example.org>, which causes the LMTP or submission component to crash (Openwall List).

The vulnerability allows malicious actors to cause a denial of service to mail delivery by repeatedly sending emails with bad sender or recipient addresses. For the submission service, triggering the bug requires valid credentials, while for LMTP, the risk is considered more significant as it can affect mail delivery services (Openwall List).

The vulnerability can be exploited by sending mail with an envelope sender or recipient formatted as <""@example.org>. For the submission service, exploitation requires valid authentication credentials. The LMTP service is typically behind a trusted MTA, but remains vulnerable to this attack vector (Openwall List).

The primary mitigation is to upgrade to Dovecot version 2.3.10.1 or later. For LMTP services, a temporary workaround involves implementing sufficient filtering at the MTA level to prevent emails with empty quoted localparts from reaching LMTP delivery. For the submission service, no workaround is available other than upgrading, though the requirement for valid credentials provides some protection (Openwall List, Ubuntu Security).

Multiple Linux distributions released security advisories and patches for this vulnerability, including Ubuntu (USN-4361-1), Debian (DSA-4690), and Fedora. The vulnerability was rated as 'important' in severity by these distributions, leading to rapid patch deployment (Ubuntu Security, Debian Security).