Advisories » MGASA-2019-0072

Updated dovecot packages fix security vulnerability

Publication date: 13 Feb 2019
Modification date: 13 Feb 2019
Type: security
Affected Mageia releases : 6
CVE: CVE-2019-3814

Description

CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted
certificate with missing username field (ssl_cert_username_field), under
some configurations Dovecot mistakenly trusts the username provided via
authentication instead of failing.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=24314
• https://www.dovecot.org/list/dovecot-news/2019-February/000393.html
• https://www.openwall.com/lists/oss-security/2019/02/05/1
• https://www.debian.org/security/2019/dsa-4385
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3814

SRPMS

6/core

• dovecot-2.2.36.1-1.mga6