Arch Linux Security Advisory ASA-202106-57
=========================================
Severity: Medium
Date    : 2021-06-22
CVE-ID  : CVE-2020-28200
Package : pigeonhole
Type    : denial of service
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2088

Summary
======
The package pigeonhole before version 0.5.15-1 is vulnerable to denial
of service.

Resolution
=========
Upgrade to 0.5.15-1.

# pacman -Syu "pigeonhole>=0.5.15-1"

The problem has been fixed upstream in version 0.5.15.

Workaround
=========
Disabling the regex sieve extension avoids the worst problems.
lmtp_user_concurrency_limit may also be helpful.

Description
==========
A security issue has been found in Pigeonhole before version 0.5.15.
The Sieve interpreter is not protected against abusive scripts that
claim excessive resource usage, especially scripts using massive
amounts of regexps. This means an attacker can cause a denial of
service of the mail delivery system by using excessive amount of CPU
and/or reaching the lmtp/lda process limits.

Impact
=====
A user could consume an excessive amount of CPU resources through
crafted Sieve scripts.

References
=========
https://dovecot.org/pipermail/dovecot-news/2021-June/000458.html
https://dovecot.org/pipermail/dovecot-news/2021-June/000460.html
https://github.com/dovecot/pigeonhole/commit/68505e444f91ebd784d419a8c11f1bc3fda3ceab
https://security.archlinux.org/CVE-2020-28200