Noobosaurus

**Name of the Vulnerable Software and Affected Versions** dovecot versions prior to 2.4.5-1.1 **Description** An authentication flaw exists where remote token validation paths fail to enforce configured authorization policies when multiple scopes are required. An attacker possessing an OAuth2 token with only a subset of the necessary scopes can successfully authenticate, whereas local token validation correctly requires all specified scopes. This results in the acceptance of tokens that lack the full set of required permissions. **Recommendations** Update to version 2.4.5-1.1. Use local token validation to ensure tokens are validated locally.

**Name of the Vulnerable Software and Affected Versions** dovecot versions prior to 2.4.5-1.1 **Description** An attacker with valid credentials can cause a denial of service for IMAP by selecting a compression algorithm for the connection that requires excessive memory for its decompression state. By opening several such connections, the process memory limit is reached, resulting in the termination of the process and all associated connections. **Recommendations** Update to version 2.4.5-1.1. Disable IMAP compression. Limit the number of connections handled by a single imap-login process.