Medium ELSA-2022-1950 1 CVE

Moderate: dovecot security update (Oracle Linux 8)

Published May 17, 2022 · Updated May 17, 2022

Ecosystem: Oracle Linux

Summary

[1:2.3.16-2]
- do not disable xz/lzma for now despite being deprecated

[1:2.3.16-1]
- dovecot updated to 2.3.16, pigeonhole to 0.5.16
- fix CVE-2021-33515 plaintext commands injection (#1980014)

Fixed packages 5

Release	Package	Fixed in
Oracle Linux · 8	dovecot	1:2.3.16-2.el8
Oracle Linux · 8	dovecot-devel	1:2.3.16-2.el8
Oracle Linux · 8	dovecot-mysql	1:2.3.16-2.el8
Oracle Linux · 8	dovecot-pgsql	1:2.3.16-2.el8
Oracle Linux · 8	dovecot-pigeonhole	1:2.3.16-2.el8

Vulnerabilities 1

Unscored —

CVE-2021-33515

The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information ca…

dovecot dovecot dovecot dovecot Debian Ubuntu Azure Linux Alpine

Jun 28, 2021