Description
Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | 1:1.0.10-1 | — |
| Debian 13 | dovecot | 1:1.0.10-1 | — |
| Debian 12 | dovecot | 1:1.0.10-1 | — |
| Debian 4.0 | dovecot | 1.0.rc15-2etch3 | DSA-1457-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | dovecot | 1.0.7-2.el5 | RHSA-2008:0297 |
Advisories 2
- RHSA-2008:0297 Red Hat Security Advisory: dovecot security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1457-1 dovecot Debian Security (DSA / DLA) · Mar 9, 2026
References
- 28434 third-party-advisory
- 30342 third-party-advisory
- oval:org.mitre.oval:def:10458 vdb-entry signature
- 20080103 Re: rPSA-2008-0001-1 dovecot mailing-list
- RHSA-2008:0297 vendor-advisory
- USN-567-1 vendor-advisory
- 27093 vdb-entry
- ADV-2008-0017 vdb-entry
- 39876 vdb-entry
- SUSE-SR:2008:020 vendor-advisory
- 20080103 rPSA-2008-0001-1 dovecot mailing-list
- DSA-1457 vendor-advisory
- [Dovecot-news] 20071221 Security hole #4: Specific LDAP + auth cache configuration may mix up user logins mailing-list
- 32151 third-party-advisory
- 28404 third-party-advisory
- 28271 third-party-advisory
- [Dovecot-news] 20071229 v1.0.10 released mailing-list
- https://issues.rpath.com/browse/RPL-2076
- 28227 third-party-advisory