Mailu affected by dovecot CVE-2020-25275, CVE-2020-24386, CVE-2020-12100

[sbias]

CVE-2020-25275
Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts.

CVE-2020-24386
An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).

by checking the dovecot-version in mailu imap container (master-tag) i get version 2.3.11.3 , so i'm not sure if that fix has been backported or not.

bash-5.0# dovecot --version
2.3.11.3 (502c39af9)

[peter-englmaier]

in 1.7 is still 2.3.10.1. I hope there will be an update soon. Are you running 1.8 or master?

[peter-englmaier]

According to this: https://repology.org/project/dovecot/versions
the upstream alpine has not released a version with the fix (only release Edge has dovecot 2.3.13).
However, 2.3.11.3 is in alpine 3.12 which is used in master. We will have to wait for next alpine release or build our own dovecot based on alpine edge. Not sure if it won't break everything in mailu 1.17.

[mawilmsen]

Voting for a fix in 1.8, which is running on alpine 3.12 afaik!

[micw]

I created an issue in the alpine bug tracker: https://gitlab.alpinelinux.org/alpine/aports/-/issues/12286
Hope they get it fixed very soon, otherwise we need to find a workaround.

[peter-englmaier]

Thanks micw, that was a good idea. I could build the container with 'alpine:edge' for version 1.7, but that doesn't mean it will work. I do not want to lose email, so I keep waiting for an official fix from the mailu developers.

[peter-englmaier]

Ok, I jumped the line and tried it out:

--- a/core/dovecot/Dockerfile
+++ b/core/dovecot/Dockerfile
@@ -1,4 +1,4 @@
-ARG DISTRO=alpine:3.12
+ARG DISTRO=alpine:edge

then, I have build with (git branch master)
docker build . -t dovecot:myversion
and modified my docker-compose to use image dovecot:myversion.

This worked, I can still receive email and my dovecot version is now:
2.3.13 (89f716dc2)
Otherweise my mailu install is still version 1.7

If you follow this, please do not forget to revert to official images as soon as the version has been upgraded.

[foosinn]

I can confirm that upgrading to alpine:edge works well. Thanks @peter-englmaier!

It bugs me quite a bit that alpine is keeping the issue internal even though the CVE is well known.

[micw]

It bugs me too. I created an issue since I did not find any and it got closed because there's already a hidden one...

I've seen that alpine 3.13 was recently released - does this contain a patched version of dovecot?

[foosinn]

Hmm, there is neither a cloud image nor a docker image for 3.13 availible.

The mirrors have the files and seems to be up to date:
http://mirror.leaseweb.com/alpine/v3.13/main/x86_64/dovecot-2.3.13-r0.apk

[micw]

Good finding. I tried to quick-check it but did not find anything (packages are not even listed in https://pkgs.alpinelinux.org/packages?name=&branch=v3.13)

So maybe we wait till tomorrow ^^

Does anyone have the time to test 1.7 with alpine 3.13? I can test 1.8 on my own server.

[foosinn]

I'll do that this late evening (CET Timezone). Do you want it for all the images or just the postfix one?

[peter-englmaier]

I already "tested" edge with 1.7 and it worked for me. I have, however, no idea what to test really. All I did is: build docker image using master branch, check version of dovecot inside, and integrate it in my 1.7 setup. I am using mailu only for some tiny mail domains of my own. Not much traffic, but it keeps coming.

@foosinn: we need only the dovecot image rebuild on the 1.7 branch with the new alpine base image. But there are errors when building the image (at least with alpine:edge). It cleanly builds only with the master branch. Mailu/1.7 must work with every possible setup and is currently the official latest version while 1.8 is preview.

[micw]

AFAIK 1.8 is the current stable

[peter-englmaier]

The last news I remember stated it is not. And the documentation says:
https://mailu.io/1.8/

You are currently browsing documentation for the 1.8 branch. Documentation for the stable 1.7 branch can be found here.

It would be best to have 1.7 fixed (most users I think are still on 1.7).

[micw]

I'm about to create a patched dovecot package for alpine 3.10. Who could create a 1.7 docker from it and try if it properly works?

[micw]

It turned out that there's another security issue, CVE-2020-12100. While I was able to modify the (small) patches for the initial two CVEs to work with the dovecot version in alpine 3.10, I failed with the (quite large) patch for CVE-2020-12100.
Alpine will very likely upgrade 3.10 and 3.11 to the fixed dovecot version. If so, we can probably switch directly to 3.13 with Mailu 1.7

[Nebukadneza]

Sorry for the late reply from the team on this pressing issue — and biiig big thanks to @micw for taking this on! In the same sense thanks to everyone who participated here and discussed and prototyped solutions.

Kudos to @micw s work, we now have a merged master update to the just-released alpine:3.13, which include the necessary fixes, as far as i have understood the patchset on aports. Backports to mailu 1.7 and 1.7 are underway:

• Use alpine 3.13 to fix CVE-2020-25275 and CVE-2020-24386 #1732
• Use alpine 3.13 to fix CVE-2020-25275 and CVE-2020-24386 (bp #1730) #1735

Unless there are some arguments against using alpine:3.13 for the 2 older mailu versions, I believe this is the best way to go. The alternatives (waiting for alpine / backporting the complicated patchset to the current 3.10-dovecot / custom-backporting the aports-master dovecot to 3.10) don’t sound appealing to me, and in my tests on both 1.7 and 1.8, the alpine:3.13 dovecot container behaved nicely, including upgrade-path and all.

A github security advisory is going to be published once the pullrequests (or alternatives) are merged.

Thanks everyone for your collaboration!

[Nebukadneza]

I’m going ahead and close this issue, the PRs for the fixes are referenced, new images uploaded to dockerhub, and a github security advisory including a few quick update notes is published here:
GHSA-3h96-x359-qrwm

Thanks to everyone!

[sbias]

(bit late but ...) confirmation for kubernetes, everything works fine in my setup with version2.3.13 . Thanks all :)

[peter-englmaier]

Same here, version 1.7 works fine.