CVE-2020-25275: 
Dovecot vulnerability analysis and mitigation

Dovecot before version 2.3.13 contained a vulnerability (CVE-2020-25275) involving improper input validation in lda, lmtp, and imap components. The vulnerability was discovered by Innokentii Sennovskiy from BI.ZONE and was publicly disclosed on January 4, 2021. The issue affects mail delivery and parsing functionality when processing email messages with specific MIME part configurations (Dovecot News, OSS Security).

The vulnerability occurs when processing an email message where the 10,000th MIME part is message/rfc822 or if the parent was multipart/digest. This issue was introduced as a side effect of earlier MIME parsing changes implemented to address CVE-2020-12100. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can lead to an application crash, enabling a malicious sender to repeatedly crash Dovecot by sending or uploading messages with more than 10,000 MIME parts. The impact is primarily focused on service availability, with no direct impact on confidentiality or integrity of the system (Dovecot News).

The vulnerability can be exploited remotely by sending specially crafted email messages. No special privileges or user interaction are required to exploit this vulnerability. However, these malicious messages are typically dropped by Mail Transfer Agents (MTAs), which provides some natural mitigation (OSS Security).

The primary mitigation is to upgrade to Dovecot version 2.3.13 or later. For systems that cannot immediately upgrade, a workaround exists where the MTA can be configured to drop messages with excessive MIME parts. Multiple Linux distributions have released security updates to address this vulnerability, including Debian (version 1:2.3.4.1-5+deb10u5), Fedora, and Gentoo (Debian Security, Gentoo Security).