CVE-2020-7046: 
Dovecot vulnerability analysis and mitigation

The vulnerability CVE-2020-7046 affects lib-smtp in submission-login and lmtp components in Dovecot 2.3.9 before version 2.3.9.3. The vulnerability was discovered by Open-Xchange oy and was disclosed on February 12, 2020 (Openwall, Dovecot News).

The vulnerability is classified as an Improper Input Validation (CWE-30) issue with a CVSS score of 7.5 (CVSS3.1:AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The lib-smtp component doesn't handle truncated command parameters properly, which results in an infinite loop consuming 100% CPU for the affected process (Openwall).

The vulnerability can lead to denial of service and CPU resource exhaustion. When exploited, attackers can cause submission-login and lmtp processes to be exhausted, affecting the server's performance and availability (Openwall).

The vulnerability can be triggered by unauthenticated users through the submission-login service, making it particularly concerning. The issue affects both LMTP (where impact is less significant) and submission-login processes (Openwall).

The vulnerability was fixed in Dovecot version 2.3.9.3. Users are advised to upgrade to this version or later to mitigate the risk (Fedora Update, Openwall).