Description
The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | 1:1.0.15-2.2 | — |
| Debian 13 | dovecot | 1:1.0.15-2.2 | — |
| Debian 12 | dovecot | 1:1.0.15-2.2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | dovecot | 1.0.7-7.el5 | RHSA-2009:0205 |
Advisories 1
- RHSA-2009:0205 Red Hat Security Advisory: dovecot security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 32164 third-party-advisory
- 32471 third-party-advisory
- 33149 third-party-advisory
- ADV-2008-2745 vdb-entry
- FEDORA-2008-9202 vendor-advisory
- oval:org.mitre.oval:def:10376 vdb-entry signature
- 31587 vdb-entry
- FEDORA-2008-9232 vendor-advisory
- MDVSA-2008:232 vendor-advisory
- USN-838-1 vendor-advisory
- SUSE-SR:2009:004 vendor-advisory
- GLSA-200812-16 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=240409
- RHSA-2009:0205 vendor-advisory
- 33624 third-party-advisory
- [Dovecot-news] 20081005 v1.1.4 released mailing-list
- 36904 third-party-advisory