Description
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | 1:2.0.18-1 | — |
| Debian 13 | dovecot | 1:2.0.18-1 | — |
| Debian 12 | dovecot | 1:2.0.18-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | dovecot +4 | 1:2.0.9-5.el6 | RHSA-2013:0520 |
Advisories 1
- RHSA-2013:0520 Red Hat Security Advisory: dovecot security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 46886 third-party-advisory
- RHSA-2013:0520 vendor-advisory
- https://bugs.gentoo.org/show_bug.cgi?id=390887
- https://bugzilla.redhat.com/show_bug.cgi?id=754980
- 52311 third-party-advisory
- http://hg.dovecot.org/dovecot-2.0/rev/5e9eaf63a6b1
- [dovecot-news] 20111117 v2.0.16 released mailing-list
- [oss-security] 20111118 Re: CVE Request -- Dovecot -- Validate certificate's CN against requested remote server hostname when proxying mailing-list
- [oss-security] 20111118 Re: CVE Request -- Dovecot -- Validate certificate's CN against requested remote server hostname when proxying mailing-list