Red Hat Security AdvisoryRHSA-2013:0520
dovecot security and bug fix update
Released 2013-02-20 · Red Hat rating Low · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server (v. 6) dovecot-1:2.0.9-5.el6, dovecot-1:2.0.9-5.el6.ppc, dovecot-mysql-1:2.0.9-5.el6 +2
- Red Hat Enterprise Linux Server Optional (v. 6) dovecot-1:2.0.9-5.el6, dovecot-devel-1:2.0.9-5.el6
- Red Hat Enterprise Linux Workstation (v. 6) dovecot-1:2.0.9-5.el6, dovecot-mysql-1:2.0.9-5.el6, dovecot-pgsql-1:2.0.9-5.el6 +1
- Red Hat Enterprise Linux Workstation Optional (v. 6) dovecot-1:2.0.9-5.el6, dovecot-devel-1:2.0.9-5.el6
Fixes 3 records
Priority LOW 33
script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote authenticated users to conduct directory traversal attacks by leveraging a script.
CVSS 2.0MEDIUM 6.5· Network · Low privileges · Interaction — · EPSS 0.02206 · Published 2011-05-24 · Fixed CWE-22
Priority LOW 33
script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration settings, which might allow remote authenticated users to bypass intended access restrictions by leveraging a script.
CVSS 2.0MEDIUM 6.5· Network · Low privileges · Interaction — · EPSS 0.0201 · Published 2011-05-24 · Fixed CWE-16
Priority LOW 29
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X…
CVSS 2.0MEDIUM 5.8· Network · No auth · Interaction — · EPSS 0.01321 · Published 2013-03-07 · Fixed CWE-20
THREATIST.IORead the docs