Red Hat Security AdvisoryRHSA-2009:0205
dovecot security and bug fix update
Released 2009-01-20 · Red Hat rating Low · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) dovecot-1.0.7-7.el5, dovecot-1.0.7-7.el5.i386, dovecot-1.0.7-7.el5.ia64 +1
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) dovecot-1.0.7-7.el5, dovecot-1.0.7-7.el5.i386
Fixes 2 records
Priority LOW 37
The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02328 · Published 2008-10-15 · Fixed CWE-863
Priority LOW 11
dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password parameter value.
CVSS 2.0LOW 2.1· Local · No auth · Interaction — · EPSS 0.00372 · Published 2008-10-31 · Fixed CWE-732
