Debian Security Advisory
DLA-1667-1 dovecot -- LTS security update
- Date Reported:
- 07 Feb 2019
- Affected Packages:
- dovecot
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2019-3814.
- More information:
-
It was discovered that there was a vulnerability in the dovecot IMAP/POP3 server.
A flaw in the TLS username handling could lead to an attacker logging in as anyone else in the system if both auth_ssl_{require_client,username_from}_cert were enabled.
For Debian 8
Jessie
, this issue has been fixed in dovecot version 1:2.2.13-12~deb8u5.We recommend that you upgrade your dovecot packages.