Chiwopsezo chachikulu mu seva ya Dovecot IMAP

Π’ zotsitsimutsa POP3/IMAP4 maseva Dovecot 2.3.7.2 ndi 2.2.36.4, komanso muzowonjezera Pigeonhole 0.5.7.2 ndi 0.4.24.2 , kuthetsedwa kusatetezeka kwambiri (CVE-2019-11500), zomwe zimakulolani kuti mulembe zambiri kupitilira buffer yomwe mwapatsidwa potumiza pempho lopangidwa mwapadera kudzera pa protocol ya IMAP kapena ManageSieve.

Vutoli litha kugwiritsidwa ntchito pa pre-authentication stage. Kugwiritsa ntchito sikunakonzedwebe, koma opanga a Dovecot samaletsa kuthekera kogwiritsa ntchito chiwopsezo kupanga ziwopsezo zakutali pamakina kapena kutulutsa zinsinsi. Ogwiritsa ntchito onse akulimbikitsidwa kukhazikitsa zosintha nthawi yomweyo (Debian, Fedora, Arch Linux, Ubuntu, SUSE, RHEL, FreeBSD).

Chiwopsezochi chilipo mu zophatikiza za protocol za IMAP ndi ManageSieve ndipo zimayamba chifukwa chakusintha kwa zilembo zachabechabe popanga data mkati mwa zingwe zogwidwa mawu. Vutoli limatheka polemba deta yosasinthika kuzinthu zomwe zasungidwa kunja kwa buffer (mpaka 8 KB ikhoza kulembedwa pa siteji isanatsimikizidwe, mpaka 64 KB pambuyo pa kutsimikizika).

Ndi malingaliro Malinga ndi mainjiniya ochokera ku Red Hat, kugwiritsa ntchito vutoli pakuwukira kwenikweni ndikovuta chifukwa wowukirayo sangathe kuwongolera malo omwe amalembedwa molakwika mulu. Poyankha, lingaliro likufotokozedwa kuti izi zimangosokoneza kwambiri kuukirako, koma sizikupatula kukhazikitsidwa kwake - wowukirayo amatha kubwereza kuyesa kuzunzika nthawi zambiri mpaka atalowa m'malo ogwirira ntchito mulu.

Source: opennet.ru

Kuwonjezera ndemanga