Summary
[1:2.3.21-19]
- update release for rebuild
[1:2.3.21-18]
- fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161626)
- fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162274)
- fix CVE-2026-27857: denial of service via specially crafted NOOP command (RHEL-161665)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | dovecot | 1:2.3.21-19.el10_2 |
| Oracle Linux · 10 | dovecot-devel | 1:2.3.21-19.el10_2 |
| Oracle Linux · 10 | dovecot-mysql | 1:2.3.21-19.el10_2 |
| Oracle Linux · 10 | dovecot-pgsql | 1:2.3.21-19.el10_2 |
| Oracle Linux · 10 | dovecot-pigeonhole | 1:2.3.21-19.el10_2 |
Vulnerabilities 3
-
High 7.5
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageS…
-
High 7.5
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount…
-
Medium 4.3
Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands w…