A dovecot security update has been released for CentOS 7.

CentOS-announce: CESA-2020:3617 Important CentOS 7 dovecot Security Update

CentOS Errata and Security Advisory 2020:3617 Important

Upstream details at :   https://access.redhat.com/errata/RHSA-2020:3617

The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )

x86_64:
6ce4ad3c854d89718c469df1d4f7aeac6a8434556118275bb4b324847dcc6b1f dovecot-2.2.36-6.el7_8.1.i686.rpm
e391cbeba08b1519396239fcb00b50bb663881d27aa8031ba222df613dce2159 dovecot-2.2.36-6.el7_8.1.x86_64.rpm
43b14f32642d28cb2b456d2c10d7d41b98a6a61b92d5253d53947fa632c0865e dovecot-devel-2.2.36-6.el7_8.1.x86_64.rpm
a86f968d5072fb2464dd3095f2b48710970d6b1f5d3c83d008ed4a0bfcb9e54e dovecot-mysql-2.2.36-6.el7_8.1.x86_64.rpm
ace8e5be7f1920a9fdea7a76700ad4a8c228f900df17c1d6faa46853d978e9cf dovecot-pgsql-2.2.36-6.el7_8.1.x86_64.rpm
72d08ad4f4c6d877481367326333c5adac6be70cf4cef41f54cb4d48736681ce dovecot-pigeonhole-2.2.36-6.el7_8.1.x86_64.rpm

Source:
bf4ea5803ec61ca57f4908afec4a403fc6ad7482010cc2a73596600201d49e6f dovecot-2.2.36-6.el7_8.1.src.rpm