Summary
It was discovered that Dovecot incorrectly handled client certificates. A
remote attacker in possession of a valid certificate with an empty username
field could possibly use this issue to impersonate other users.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | dovecot | 1:2.2.9-1ubuntu2.5 |
| Ubuntu · 16.04 LTS 16.04:LTS | dovecot | 1:2.2.22-1ubuntu2.9 |
| Ubuntu · 18.04 LTS 18.04:LTS | dovecot | 1:2.2.33.2-1ubuntu4.2 |
Vulnerabilities 1
-
High 7.7
It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote a…
References
-
report
https://ubuntu.com/security/CVE-2019-3814