Mailcow-dockerized: Container update: CVE-2020-13777 in gnutls

[a3li]

At the very least, the most recent dovecot container contains a vulnerable gnutls version, fix is in 3.6.7-4+deb10u4:

❯ docker run -it --entrypoint /bin/bash mailcow/dovecot:1.126
root@82ea68e430f6:/# dpkg -l | grep gnutls
ii  libgnutls30:amd64             3.6.7-4+deb10u3              amd64        GNU TLS library - main runtime library

Would be cool to get updated container(s). Thanks!

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13777
https://www.debian.org/security/2020/dsa-4697

[mkuron]

Thanks for reporting. The library is actually installed inside most of our containers:

• rspamd
• dovecot
• postfix
• phpfpm
• mariadb
• sogo
• clamd
• solr
• unbound

Looking through them however, GnuTLS is exclusively used as a client library (e.g. by apt, gnupg, curl, dovecot-ldap, dovecot-mysql, postfix-mysql, sogo, wget). Our public-facing TLS servers (Postfix, Dovecot, Nginx) use OpenSSL and are thus safe.

The GnuTLS developers say

This caused the TLS server to not securely construct a session ticket encryption key considering the application supplied secret, allowing a MitM attacker [...]

So only servers need to immediately update to mitigate a security issue. Mailcow is not affected.

[a3li]

And thanks for checking! The reason I filed this is the press (Heise…) citing Dovecot as being affected.

Since you left the issue open, I guess I'll leave it as such for your delayed closing pleasure. :)

[mkuron]

I‘ll leave it open for a few more days so people see it and don‘t open a new issue for the same CVE.