It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users.
CVSS Details
- CVSS 3.1 Base Score: 7.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade dovecot | Aug 22, 2024 | Mar 27, 2019 |
| Amazon Linux Ami 2 | — | Upgrade dovecot-debuginfoUpgrade dovecotUpgrade dovecot-pigeonholeUpgrade dovecot-pgsqlUpgrade dovecot-mysqlUpgrade dovecot-devel | Aug 25, 2020 | Mar 27, 2019 |
| Amazon_linux | — | Upgrade dovecot | May 15, 2020 | Jan 16, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Mar 27, 2019 |
| Centos_linux | — | Upgrade dovecot-mysql-debuginfoUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-debugsourceUpgrade dovecot-develUpgrade dovecot-pigeonholeUpgrade dovecot-pgsqlUpgrade dovecot-mysqlUpgrade dovecot-debuginfoUpgrade dovecot | Nov 6, 2019 | Mar 27, 2019 |
| Debian | — | Upgrade dovecot | Feb 7, 2019 | Jan 16, 2019 |
| Freebsd | — | Upgrade dovecot | Feb 6, 2019 | Feb 5, 2019 |
| Gentoo Linux | — | Upgrade net-mail/dovecot. | Apr 18, 2019 | Mar 27, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade dovecot-pgsqlUpgrade dovecot-mysqlUpgrade dovecotUpgrade dovecot-pigeonhole | May 1, 2019 | Mar 27, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade dovecot-pigeonholeUpgrade dovecot-pgsqlUpgrade dovecot-mysqlUpgrade dovecot | May 30, 2019 | Mar 27, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade dovecot-pgsqlUpgrade dovecot-pigeonholeUpgrade dovecotUpgrade dovecot-mysql | May 1, 2019 | Mar 27, 2019 |
| Oracle_linux | — | Upgrade dovecot-mysqlUpgrade dovecotUpgrade dovecot-pgsqlUpgrade dovecot-pigeonholeUpgrade dovecot-devel | Oct 5, 2022 | Feb 5, 2019 |
| Redhat_linux | — | No solution existsUpgrade dovecotUpgrade dovecot-debuginfoUpgrade dovecot-mysql-debuginfoUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-pigeonholeUpgrade dovecot-pgsqlUpgrade dovecot-mysqlUpgrade dovecot-develUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-debugsource | Nov 6, 2019 | Mar 27, 2019 |
| Suse | — | Upgrade dovecot22-develUpgrade dovecot22-backend-pgsqlUpgrade dovecot23-fts-solrUpgrade dovecot23Upgrade dovecot22-backend-sqliteUpgrade dovecot23-fts-squatUpgrade dovecot23-backend-mysqlUpgrade dovecot23-backend-sqliteUpgrade dovecot23-fts-luceneUpgrade dovecot23-develUpgrade dovecot22Upgrade dovecot23-ftsUpgrade dovecot22-backend-mysqlUpgrade dovecot23-backend-pgsql | Feb 27, 2019 | Jan 16, 2019 |
| Ubuntu | — | Upgrade dovecot-core | Feb 13, 2019 | Jan 16, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub