A dovecot security update has been released for Debian GNU/Linux 8 Extended LTS to address several vulnerabilities.

ELA-260-1 dovecot security update

Package dovecot
Version 1:2.2.13-12~deb8u8
Related CVEs CVE-2020-12100 CVE-2020-12673 CVE-2020-12674

Several vulnerabilities have been discovered in the Dovecot email server.

CVE-2020-12100

Receiving mail with deeply nested MIME parts leads to resource
exhaustion as Dovecot attempts to parse it.
CVE-2020-12673

Dovecot's NTLM implementation does not correctly check message
buffer size, which leads to a crash when reading past allocation.
CVE-2020-12674

Dovecot's RPA mechanism implementation accepts zero-length message,
which leads to assert-crash later on.
For Debian 8 jessie, these problems have been fixed in version 1:2.2.13-12~deb8u8.

We recommend that you upgrade your dovecot packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

  ELA-260-1 dovecot security update