Description
The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | 1.2.13-1 | — |
| Debian 13 | dovecot | 1.2.13-1 | — |
| Debian 12 | dovecot | 1.2.13-1 | — |
References
- [dovecot-news] 20100724 v1.2.13 released mailing-list
- [oss-security] 20100916 Re: CVE-identifier request for Dovecot ACL security bug mailing-list
- USN-1059-1 vendor-advisory
- 41964 vdb-entry
- [oss-security] 20100916 CVE-identifier request for Dovecot ACL security bug mailing-list
- MDVSA-2010:217 vendor-advisory
- 43220 third-party-advisory
- ADV-2011-0301 vdb-entry
- ADV-2010-2840 vdb-entry
- SUSE-SR:2010:017 vendor-advisory