CVE-2020-28200: 
Dovecot vulnerability analysis and mitigation

CVE-2020-28200 affects the Sieve engine in Dovecot versions before 2.3.15. The vulnerability was discovered in 2020 and publicly disclosed on June 28, 2021. This security issue allows Uncontrolled Resource Consumption in the Sieve engine, particularly when dealing with complex regular expressions using the regex extension (NVD, Dovecot Security).

The vulnerability is classified as an Uncontrolled Resource Consumption (CWE-770) issue. It has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. The vulnerability specifically affects the Sieve interpreter, which lacks protection against abusive scripts that can cause excessive resource usage through complex regular expressions in the regex extension (OSS Security).

The vulnerability can allow an attacker to cause uncontrolled CPU resource consumption, potentially leading to partial or complete denial of service. When exploited, the attack can significantly impact server performance through excessive resource utilization (OSS Security).

The vulnerability can be exploited by using sufficiently CPU-intensive regular expressions in Sieve scripts. The attack requires valid authentication to the system as it needs the ability to create and execute Sieve scripts (OSS Security).

The primary mitigation is to upgrade to Dovecot version 2.3.15 or later, which implements limits on both CPU system+user time per single script execution and cumulative usage over several script runs within a configurable timeout period. As a temporary workaround, administrators can disable the Sieve 'regex' extension (OSS Security, Dovecot Security).