dovecot: CVE-2019-11500

Debian Bug report logs - #936014
dovecot: CVE-2019-11500

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: dovecot: CVE-2019-11500

Date: Thu, 29 Aug 2019 07:12:54 +0200

Source: dovecot
Version: 1:2.3.4.1-5
Severity: grave
Tags: security upstream
Justification: user security hole
Control: found -1 1:2.2.27-3+deb9u4
Control: found -1 1:2.2.27-3
Control: fixed -1 1:2.2.27-3+deb9u5
Control: fixed -1 1:2.3.4.1-5+deb10u1

Hi,

The following vulnerability was published for dovecot.

CVE-2019-11500[0]:
| Nick Roessler and Rafi Rubin discovered that the IMAP and ManageSieve
| protocol parsers in the Dovecot email server do not properly validate
| input (both pre- and post-login). A remote attacker can take advantage
| of this flaw to trigger out of bounds heap memory writes, leading to
| information leaks or potentially the execution of arbitrary code.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-11500
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11500
[1] https://dovecot.org/pipermail/dovecot-news/2019-August/000418.html

Regards,
Salvatore

Send a report that this bug log contains spam.