Stay Secure with the Latest Linux Advisories

security advisorydenial of servicemedium severity

Arch Linux: ASA-202106-57 Medium: Pigeonhole DoS Threat

The package pigeonhole before version 0.5.15-1 is vulnerable to denial of service. . Arch Linux Security Advisory ASA-202106-57 ========================================= Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2020-28200 Package : pigeonhole Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2088 Summary ====== The package pigeonhole before version 0.5.15-1 is vulnerable to denial of service. Resolution ========= Upgrade to 0.5.15-1. # pacman -Syu "pigeonhole> =0.5.15-1" The problem has been fixed upstream in version 0.5.15. Workaround ========= Disabling the regex sieve extension avoids the worst problems. lmtp_user_concurrency_limit may also be helpful. Description ========== A security issue has been found in Pigeonhole before version 0.5.15. The Sieve interpreter is not protected against abusive scripts that claim excessive resource usage, especially scripts using massive amounts of regexps. This means an attacker can cause a denial of service of the mail delivery system by using excessive amount of CPU and/or reaching the lmtp/lda process limits. Impact ===== A user could consume an excessive amount of CPU resources through crafted Sieve scripts. References ========= https://dovecot.org/pipermail/dovecot-news/2021-June/000458.html https://dovecot.org/pipermail/dovecot-news/2021-June/000460.html https://github.com/dovecot/pigeonhole/commit/68505e444f91ebd784d419a8c11f1bc3fda3ceab https://security.archlinux.org/CVE-2020-28200 . Arch Linux Advisory ASA-202303-42: Pigeonhole versions before 0.5.15-1 carry a medium risk of denial of service vulnerabilities.. Arch Linux Security Advisory, Pigeonhole Denial of Service, Medium Severity. . Severity: Medium. LinuxSecurity.com Team

Jun 24, 2021 •Medium ArchLinux