Description
dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password parameter value.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | No fix yet | — |
| Debian 13 | dovecot | No fix yet | — |
| Debian 12 | dovecot | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | dovecot | 1.0.7-7.el5 | RHSA-2009:0205 |
Advisories 1
- RHSA-2009:0205 Red Hat Security Advisory: dovecot security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 32164 third-party-advisory
- [oss-security] 20081029 CVE Request (dovecot) mailing-list
- 33149 third-party-advisory
- dovecot-dovecot-information-disclosure(46323) vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=436287
- GLSA-200812-16 vendor-advisory
- RHSA-2009:0205 vendor-advisory
- 33624 third-party-advisory
- oval:org.mitre.oval:def:10776 vdb-entry signature