Summary
[1:2.3.16-18]
- rebuild
[1:2.3.16-17]
- fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161640)
- fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162288)
- fix CVE-2026-27857: denial of service via specially crafted NOOP command (RHEL-161679)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | dovecot | 1:2.3.16-18.el9_8 |
| Oracle Linux · 9 | dovecot-devel | 1:2.3.16-18.el9_8 |
| Oracle Linux · 9 | dovecot-mysql | 1:2.3.16-18.el9_8 |
| Oracle Linux · 9 | dovecot-pgsql | 1:2.3.16-18.el9_8 |
| Oracle Linux · 9 | dovecot-pigeonhole | 1:2.3.16-18.el9_8 |
Vulnerabilities 3
-
High 7.5
ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageS…
-
High 7.5
Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount…
-
Medium 4.3
Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands w…