CVE-2020-7957: dovecot Improper Input Validation
Vulnerability summary
CVE-2020-7957 is a medium (CVSS 5.3) Improper Input Validation vulnerability in dovecot. EPSS estimates a 1.88% chance of exploitation in the next 30 days, higher than 79.1% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 12-02-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. This causes a denial of service in which the recipient cannot read all of their messages.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST3.1LowCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
EPSS trend
Probability
1.88%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
0.00 pp
From 1.88% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (dovecot.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- dovecot≥ 2.3.9, < 2.3.10.1-r0 | ≥ 2.3.9, < 2.3.9.3-r0
Dovecot1 product
- dovecot≥ 2.3.9, < 2.3.9.3
Fedoraproject1 product
- fedoraEOL30 | 31
3 vendors · 3 products
References
6 links- www.openwall.com/lists/oss-security/2020/02/12/2X Refsource CONFIRMExploitMailing ListThird Party Advisory
- dovecot.org/pipermail/dovecot-news/2020-February/000430.htmlX Refsource CONFIRMExploitMailing ListVendor Advisory