Red Hat Security AdvisoryRHSA-2020:1062
dovecot security and bug fix update
Released 2020-03-31 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server (v. 7) dovecot-1:2.2.36-6.el7, dovecot-1:2.2.36-6.el7.ppc, dovecot-mysql-1:2.2.36-6.el7 +2
- Red Hat Enterprise Linux Server Optional (v. 7) dovecot-devel-1:2.2.36-6.el7
- Red Hat Enterprise Linux Workstation (v. 7) dovecot-1:2.2.36-6.el7, dovecot-mysql-1:2.2.36-6.el7, dovecot-pgsql-1:2.2.36-6.el7 +1
- Red Hat Enterprise Linux Workstation Optional (v. 7) dovecot-devel-1:2.2.36-6.el7
Fixes 2 records
Priority MEDIUM 40
In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root.
CVSS 3.0HIGH 8.8· Local · Low privileges · No interaction · EPSS 0.01178 · Published 2019-03-28 · Partial fix CWE-119
Priority LOW 38
It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates.
CVSS 3.0HIGH 7.7· Network · High privileges · No interaction · EPSS 0.02417 · Published 2019-03-27 · Partial fix CWE-295
