A vulnerability has been discovered in Dovecot that can lead to a privilege escalation when master and non-master passdbs are used.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/dovecot | * | < 2.3.19.1-r1 | >= 2.3.19.1-r1 |
Dovecot is an open source IMAP and POP3 email server.
A vulnerability has been discovered in Dovecot. Please review the CVE identifier referenced below for details.
When two passdb configuration entries exist in Dovecot configuration, which have the same driver and args settings, the incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation with certain configurations involving master user authentication. Dovecot documentation does not advise against the use of passdb definitions which have the same driver and args settings. One such configuration would be where an administrator wishes to use the same pam configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
There is no known workaround at this time.
All Dovecot users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.3.19.1-r1"
Multiple vulnerabilities have been found in Dovecot, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/dovecot | * | < 2.3.14.1 | >= 2.3.14.1 |
Dovecot is an open source IMAP and POP3 email server.
Multiple vulnerabilities have been discovered in Dovecot. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Dovecot users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.3.14.1"
Multiple vulnerabilities have been found in Dovecot, the worst of which could allow remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/dovecot | * | < 2.3.13 | >= 2.3.13 |
Dovecot is an open source IMAP and POP3 email server.
Multiple vulnerabilities have been discovered in Dovecot. Please review the CVE identifiers referenced below for details.
A remote attacker could send a specially crafted mail or send a specially crafted IMAP command possibly resulting in a Denial of Service condition or an authenticated remote attacker might be able to discover the file system directory structure and access other users’ emails.
The information disclosure vulnerability can be mitigated by disabling IMAP hibernation feature which isn’t enabled by default.
All Dovecot users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.3.13"
Multiple vulnerabilities have been found in Dovecot, the worst of which could allow remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/dovecot | * | < 2.3.11.3 | >= 2.3.11.3 |
Dovecot is an open source IMAP and POP3 email server.
It was discovered that Dovecot incorrectly handled deeply nested MIME parts, incorrectly handled memory when using NTLM, and incorrectly handled zero-length messages.
A remote attacker could send a specially crafted mail or send specially crafted authentication requests possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All Dovecot users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.3.11.3"
Multiple vulnerabilities have been found in Dovecot, the worst of which could result in the arbitrary execution of code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/dovecot | * | < 2.3.7.2 | >= 2.3.7.2 |
Dovecot is an open source IMAP and POP3 email server.
Multiple vulnerabilities have been discovered in Dovecot. Please review the CVE identifiers referenced below for details.
An unauthenticated remote attacker could send a specially crafted mail or use crafted IMAP commands possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All Dovecot users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.3.7.2"
Multiple vulnerabilities have been found in Dovecot, the worst of which could result in root privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/dovecot | * | < 2.3.5.1 | >= 2.3.5.1 |
Dovecot is an open source IMAP and POP3 email server.
Multiple vulnerabilities have been discovered in Dovecot. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details
There is no known workaround at this time.
All Dovecot users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.3.5.1"
A vulnerability in Dovecot could allow a remote attacker to create a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/dovecot | * | < 2.2.13 | >= 2.2.13 |
Dovecot is an open source IMAP and POP3 email server.
Dovecot does not properly close connections, allowing a resource exhaustion for incomplete SSL/TLS handshakes.
A remote attacker could possibly cause a Denial of Service condition.
There is no known workaround at this time.
All Dovecot users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.2.13"
Multiple vulnerabilities were found in Dovecot, the worst of which allowing for remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/dovecot | * | < 2.0.13 | >= 1.2.17 (revision), >= 2.0.13 |
Dovecot is an IMAP and POP3 server written with security primarily in mind.
Multiple vulnerabilities have been discovered in Dovecot. Please review the CVE identifiers referenced below for details.
A remote attacker could exploit these vulnerabilities to cause the remote execution of arbitrary code, or a Denial of Service condition, to conduct directory traversal attacks, corrupt data, or disclose information.
There is no known workaround at this time.
All Dovecot 1 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-1.2.17"
All Dovecot 2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.0.13"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since May 28, 2011. It is likely that your system is already no longer affected by this issue.
Multiple vulnerabilities were found in the Dovecot mailserver.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/dovecot | * | < 1.1.7-r1 | >= 1.1.7-r1 |
Dovecot is an IMAP and POP3 server written with security primarily in mind.
Several vulnerabilities were found in Dovecot:
These vulnerabilities might allow a remote attacker to cause a Denial of Service, to circumvent security restrictions or allow local attackers to disclose the passphrase of the SSL private key.
There is no known workaround at this time.
All Dovecot users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-1.1.7-r1"
Users should be aware that dovecot.conf will still be world-readable after the update. If employing ssl_key_password, it should not be used in dovecot.conf but in a separate file which should be included with "include_try".
An error in the usage of the ssl-cert eclass within multiple ebuilds might allow for disclosure of generated SSL private keys.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-admin/conserver | * | < 8.1.16 | >= 8.1.16 |
| mail-mta/postfix | * | < 2.4.6-r2 | >= 2.4.6-r2, >= 2.3.8-r1 (revision), >= 2.2.11-r1 (revision) |
| net-ftp/netkit-ftpd | * | < 0.17-r7 | >= 0.17-r7 |
| net-im/ejabberd | * | < 1.1.3 | >= 1.1.3 |
| net-irc/unrealircd | * | < 3.2.7-r2 | >= 3.2.7-r2 |
| net-mail/cyrus-imapd | * | < 2.3.9-r1 | >= 2.3.9-r1 |
| net-mail/dovecot | * | < 1.0.10 | >= 1.0.10 |
| net-misc/stunnel | * | < 4.21-r1 | >= 4.21-r1, < 4.0 |
| net-nntp/inn | * | < 2.4.3-r1 | >= 2.4.3-r1 |
The ssl-cert eclass is a code module used by Gentoo ebuilds to generate SSL certificates.
Robin Johnson reported that the docert() function provided by ssl-cert.eclass can be called by source building stages of an ebuild, such as src_compile() or src_install(), which will result in the generated SSL keys being included inside binary packages (binpkgs).
A local attacker could recover the SSL keys from publicly readable binary packages when "emerge" is called with the "--buildpkg (-b)" or "--buildpkgonly (-B)" option. Remote attackers can recover these keys if the packages are served to a network. Binary packages built using "quickpkg" are not affected.
Do not use pre-generated SSL keys, but use keys that were generated using a different Certificate Authority.
Upgrading to newer versions of the above packages will neither remove possibly compromised SSL certificates, nor old binary packages. Please remove the certificates installed by Portage, and then emerge an upgrade to the package.
All Conserver users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/conserver-8.1.16"
All Postfix 2.4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-mta/postfix-2.4.6-r2"
All Postfix 2.3 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-mta/postfix-2.3.8-r1"
All Postfix 2.2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-mta/postfix-2.2.11-r1"
All Netkit FTP Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-ftp/netkit-ftpd-0.17-r7"
All ejabberd users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-im/ejabberd-1.1.3"
All UnrealIRCd users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-irc/unrealircd-3.2.7-r2"
All Cyrus IMAP Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/cyrus-imapd-2.3.9-r1"
All Dovecot users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-1.0.10"
All stunnel 4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/stunnel-4.21"
All InterNetNews users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-nntp/inn-2.4.3-r1"
Two vulnerabilities in Dovecot allow for information disclosure and argument injection.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-mail/dovecot | * | < 1.0.13-r1 | >= 1.0.13-r1 |
Dovecot is a lightweight, fast and easy to configure IMAP and POP3 mail server.
Dovecot uses the group configured via the "mail_extra_groups" setting, which should be used to create lockfiles in the /var/mail directory, when accessing arbitrary files (CVE-2008-1199). Dovecot does not escape TAB characters in passwords when saving them, which might allow for argument injection in blocking passdbs such as MySQL, PAM or shadow (CVE-2008-1218).
Remote attackers can exploit the first vulnerability to disclose sensitive data, such as the mail of other users, or modify files or directories that are writable by group via a symlink attack. Please note that the "mail_extra_groups" setting is set to the "mail" group by default when the "mbox" USE flag is enabled.
The second vulnerability can be abused to inject arguments for internal fields. No exploitation vectors are known for this vulnerability that affect previously stable versions of Dovecot in Gentoo.
There is no known workaround at this time.
All Dovecot users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-1.0.13-r1"
This version removes the "mail_extra_groups" option and introduces a "mail_privileged_group" setting which is handled safely.