It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - dovecot: Buffer overflow in indexer-worker process results in privilege escalation (CVE-2019-7524)

  - A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS     key files. (CVE-2016-4983)

  - It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client     certificates. A remote attacker in possession of a valid certificate with an empty username field could     possibly use this issue to impersonate other users. (CVE-2019-3814)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - dovecot: Buffer overflow in indexer-worker process results in privilege escalation (CVE-2019-7524)

  - Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation     time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to     the parent directories of the base_dir directory, and possibly the base_dir directory itself.
    (CVE-2009-3897)

  - Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close     old connections, which allows remote attackers to cause a denial of service (resource consumption) via an     incomplete SSL/TLS handshake for an IMAP/POP3 connection. (CVE-2014-3430)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3467 advisory.

    - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte       when scanning data in quoted strings, leading to out of bounds heap       memory writes (#1741788)
    - fix CVE-2019-3814: improper certificate validation (#1674370)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1062 advisory.

    - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte       when scanning data in quoted strings, leading to out of bounds heap       memory writes (#1741787)
    - fix CVE-2019-3814: improper certificate validation (#1674369)
    - fix CVE-2019-7524: buffer overflow in indexer-worker process resulting in privilege       escalation (#1700398)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3467 advisory.

  - dovecot: Improper certificate validation (CVE-2019-3814)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has dovecot packages installed that are affected by multiple vulnerabilities:

  - In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the     indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the     fts and pop3-uidl components. (CVE-2019-7524)

  - It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client     certificates. A remote attacker in possession of a valid certificate with an empty username field could     possibly use this issue to impersonate other users. (CVE-2019-3814)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has dovecot packages installed that are affected by multiple vulnerabilities:

  - In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the     indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the     fts and pop3-uidl components. (CVE-2019-7524)

  - It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client     certificates. A remote attacker in possession of a valid certificate with an empty username field could     possibly use this issue to impersonate other users. (CVE-2019-3814)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1473 advisory.

  - It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client     certificates. A remote attacker in possession of a valid certificate with an empty username field could     possibly use this issue to impersonate other users. (CVE-2019-3814)

  - In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the     indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the     fts and pop3-uidl components. (CVE-2019-7524)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components. (CVE-2019-7524)

It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users. (CVE-2019-3814)

* dovecot: Improper certificate validation * dovecot: Buffer overflow in indexer-worker process results in privilege escalation

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1062 advisory.

  - It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client     certificates. A remote attacker in possession of a valid certificate with an empty username field could     possibly use this issue to impersonate other users. (CVE-2019-3814)

  - In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the     indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the     fts and pop3-uidl components. (CVE-2019-7524)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1062 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: Improper certificate validation (CVE-2019-3814)

    * dovecot: Buffer overflow in indexer-worker process results in privilege escalation (CVE-2019-7524)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3467 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    Security Fix(es):

    * dovecot: Improper certificate validation (CVE-2019-3814)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

dovecot updated to 2.3.6, includes several security fixes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the dovecot packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that Dovecot incorrectly handled     client certificates. A remote attacker in possession of     a valid certificate with an empty username field could     possibly use this issue to impersonate other     users.(CVE-2019-3814)

  - In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a     local attacker can cause a buffer overflow in the     indexer-worker process, which can be used to elevate to     root. This occurs because of missing checks in the fts     and pop3-uidl components.(CVE-2019-7524)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dovecot22 fixes the following issues :

Security issues fixed :

  - CVE-2019-7524: Fixed an improper file handling which     could result in stack overflow allowing local root     escalation (bsc#1130116).

  - CVE-2019-3814: Fixed a vulnerability related to SSL     client certificate authentication (bsc#1123022).

Other issue fixed :

  - Fixed handling of command continuation (bsc#1111789).

This update was imported from the SUSE:SLE-12:Update update project.

The remote host is affected by the vulnerability described in GLSA-201904-19 (Dovecot: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Dovecot. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details   Workaround :

    There is no known workaround at this time.

This update for dovecot22 fixes the following issues :

Security issues fixed :

CVE-2019-7524: Fixed an improper file handling which could result in stack overflow allowing local root escalation (bsc#1130116).

CVE-2019-3814: Fixed a vulnerability related to SSL client certificate authentication (bsc#1123022).

Other issue fixed: Fixed handling of command continuation(bsc#1111789)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dovecot23 fixes the following issues :

dovecot was updated to 2.3.3 release, bringing lots of bugfixes (bsc#1124356).

Also the following security issue was fixed :

  - CVE-2019-3814: A vulnerability in Dovecot related to SSL     client certificate authentication was fixed     (bsc#1123022)

The package changes :

Updated pigeonhole to 0.5.3 :

  - Fix assertion panic occurring when managesieve service     fails to open INBOX while saving a Sieve script. This     was caused by a lack of cleanup after failure.

  - Fix specific messages causing an assert panic with     actions that compose a reply (e.g. vacation). With some     rather weird input from the original message, the header     folding algorithm (as used for composing the References     header for the reply) got confused, causing the panic.

  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT     command parsing. After finishing reading the Sieve     script, the command parsing sometimes didn't continue     with the search arguments. This is a time- critical bug     that likely only occurs when the Sieve script is sent in     the next TCP frame.

dovecot23 was updated to 2.3.3 :

  - doveconf hides more secrets now in the default output.

  - ssl_dh setting is no longer enforced at startup. If it's     not set and non-ECC DH key exchange happens, error is     logged and client is disconnected.

  - Added log_debug=<filter> setting.

  - Added log_core_filter=<log filter> setting.

  - quota-clone: Write to dict asynchronously

  - --enable-hardening attempts to use retpoline Spectre 2     mitigations

  - lmtp proxy: Support source_ip passdb extra field.

  - doveadm stats dump: Support more fields and output     stddev by default.

  - push-notification: Add SSL support for OX backend.

  - NUL bytes in mail headers can cause truncated replies     when fetched.

  - director: Conflicting host up/down state changes may in     some rare situations ended up in a loop of two directors     constantly overwriting each others' changes.

  - director: Fix hang/crash when multiple doveadm commands     are being handled concurrently.

  - director: Fix assert-crash if doveadm disconnects too     early

  - virtual plugin: Some searches used 100% CPU for many     seconds

  - dsync assert-crashed with acl plugin in some situations.
    (bsc#1119850)

  - mail_attachment_detection_options=add-flags-on-save     assert-crashed with some specific Sieve scripts.

  - Mail snippet generation crashed with mails containing     invalid Content-Type:multipart header.

  - Log prefix ordering was different for some log lines.

  - quota: With noenforcing option current quota usage     wasn't updated.

  - auth: Kerberos authentication against Samba     assert-crashed.

  - stats clients were unnecessarily chatty with the stats     server.

  - imapc: Fixed various assert-crashes when reconnecting to     server.

  - lmtp, submission: Fix potential crash if client     disconnects while handling a command.

  - quota: Fixed compiling with glibc-2.26 / support     libtirpc.

  - fts-solr: Empty search values resulted in 400 Bad     Request errors

  - fts-solr: default_ns parameter couldn't be used

  - submission server crashed if relay server returned over     7 lines in a reply (e.g. to EHLO)

dovecot was updated to 2.3.2.1 :

  - SSL/TLS servers may have crashed during client     disconnection

  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may     have sometimes assert-crashed.

  - v2.3.2: 'make check' may have crashed with 32bit systems

dovecot was updated to 2.3.2 :

  - old-stats plugin: Don't temporarily enable     PR_SET_DUMPABLE while opening /proc/self/io. This may     still cause security problems if the process is     ptrace()d at the same time. Instead, open it while still     running as root.

  - doveadm: Added mailbox cache decision&remove commands.
    See doveadm-mailbox(1) man page for details.

  - doveadm: Added rebuild attachments command for     rebuilding $HasAttachment or $HasNoAttachment flags for     matching mails. See doveadm-rebuild(1) man page for     details.

  - cassandra: Use fallback_consistency on more types of     errors

  - lmtp proxy: Support outgoing SSL/TLS connections

  - lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir     settings.

  - submission: Add support for rawlog_dir

  - submission: Add submission_client_workarounds setting.

  - lua auth: Add password_verify() function and additional     fields in auth request.

  - doveadm-server: TCP connections are hanging when there     is a lot of network output. This especially caused hangs     in dsync-replication.

  - Using multiple type=shared mdbox namespaces crashed

  - mail_fsync setting was ignored. It was always set to     'optimized'.

  - lua auth: Fix potential crash at deinit

  - SSL/TLS servers may have crashed if client disconnected     during handshake.

  - SSL/TLS servers: Don't send extraneous certificates to     client when alt certs are used.

  - lda, lmtp: Return-Path header without '<' may have     assert-crashed.

  - lda, lmtp: Unencoded UTF-8 in email address headers may     assert-crash

  - lda: -f parameter didn't allow empty/null/domainless     address

  - lmtp, submission: Message size limit was hardcoded to 40     MB. Exceeding it caused the connection to get dropped     during transfer.

  - lmtp: Fix potential crash when delivery fails at DATA     stage

  - lmtp: login_greeting setting was ignored

  - Fix to work with OpenSSL v1.0.2f

  - systemd unit restrictions were too strict by default

  - Fix potential crashes when a lot of log output was     produced

  - SMTP client may have assert-crashed when sending mail

  - IMAP COMPRESS: Send 'end of compression' marker when     disconnecting.

  - cassandra: Fix consistency=quorum to work

  - dsync: Lock file generation failed if home directory     didn't exist

  - Snippet generation for HTML mails didn't ignore     &entities inside blockquotes, producing strange looking     snippets.

  - imapc: Fix assert-crash if getting disconnected and     after reconnection all mails in the selected mailbox are     gone.

  - pop3c: Handle unexpected server disconnections without     assert-crash

  - fts: Fixes to indexing mails via virtual mailboxes.

  - fts: If mails contained NUL characters, the text around     it wasn't indexed.

  - Obsolete dovecot.index.cache offsets were sometimes     used. Trying to fetch a field that was just added to     cache file may not have always found it.

pigeonhole was updated to 0.5.2 :

  - Implement plugin for the a vendor-defined IMAP     capability called 'FILTER=SIEVE'. It adds the ability to     manually invoke Sieve filtering in IMAP. More     information can be found in     doc/plugins/imap_filter_sieve.txt.

  - The Sieve addess test caused an assertion panic for     invalid addresses with UTF-8 codepoints in the     localpart. Fixed by properly detecting invalid addresses     with UTF-8 codepoints in the localpart and skipping     these like other invalid addresses while iterating     addresses for the address test.

  - Make the length of the subject header for the vacation     response configurable and enforce the limit in UTF-8     codepoints rather than bytes. The subject header for a     vacation response was statically truncated to 256 bytes,     which is too limited for multi-byte UTF-8 characters.

  - Sieve editheader extension: Fix assertion panic     occurring when it is used to manipulate a message header     with a very large header field.

  - Properly abort execution of the sieve_discard script     upon error. Before, the LDA Sieve plugin attempted to     execute the sieve_discard script when an error occurs.
    This can lead to the message being lost.

  - Fix the interaction between quota and the sieve_discard     script. When quota was used together with a     sieve_discard script, the message delivery did not     bounce when the quota was exceeded.

  - Fix crash for over quota users

This update was imported from the SUSE:SLE-15:Update update project.

This update for dovecot23 fixes the following issues :

dovecot was updated to 2.3.3 release, bringing lots of bugfixes (bsc#1124356).

Also the following security issue was fixed :

CVE-2019-3814: A vulnerability in Dovecot related to SSL client certificate authentication was fixed (bsc#1123022)

The package changes :

Updated pigeonhole to 0.5.3: Fix assertion panic occurring when managesieve service fails to open INBOX while saving a Sieve script.
This was caused by a lack of cleanup after failure.

Fix specific messages causing an assert panic with actions that compose a reply (e.g. vacation). With some rather weird input from the original message, the header folding algorithm (as used for composing the References header for the reply) got confused, causing the panic.

IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command parsing.
After finishing reading the Sieve script, the command parsing sometimes didn't continue with the search arguments. This is a time- critical bug that likely only occurs when the Sieve script is sent in the next TCP frame.

dovecot23 was updated to 2.3.3: doveconf hides more secrets now in the default output.

ssl_dh setting is no longer enforced at startup. If it's not set and non-ECC DH key exchange happens, error is logged and client is disconnected.

Added log_debug=<filter> setting. </filter>

Added log_core_filter=<log filter> setting. </log>

quota-clone: Write to dict asynchronously

--enable-hardening attempts to use retpoline Spectre 2 mitigations

lmtp proxy: Support source_ip passdb extra field.

doveadm stats dump: Support more fields and output stddev by default.

push-notification: Add SSL support for OX backend.

NUL bytes in mail headers can cause truncated replies when fetched.

director: Conflicting host up/down state changes may in some rare situations ended up in a loop of two directors constantly overwriting each others' changes.

director: Fix hang/crash when multiple doveadm commands are being handled concurrently.

director: Fix assert-crash if doveadm disconnects too early

virtual plugin: Some searches used 100% CPU for many seconds

dsync assert-crashed with acl plugin in some situations. (bsc#1119850)

mail_attachment_detection_options=add-flags-on-save assert-crashed with some specific Sieve scripts.

Mail snippet generation crashed with mails containing invalid Content-Type:multipart header.

Log prefix ordering was different for some log lines.

quota: With noenforcing option current quota usage wasn't updated.

auth: Kerberos authentication against Samba assert-crashed.

stats clients were unnecessarily chatty with the stats server.

imapc: Fixed various assert-crashes when reconnecting to server.

lmtp, submission: Fix potential crash if client disconnects while handling a command.

quota: Fixed compiling with glibc-2.26 / support libtirpc.

fts-solr: Empty search values resulted in 400 Bad Request errors

fts-solr: default_ns parameter couldn't be used

submission server crashed if relay server returned over 7 lines in a reply (e.g. to EHLO)

dovecot was updated to 2.3.2.1: SSL/TLS servers may have crashed during client disconnection

lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have sometimes assert-crashed.

v2.3.2: 'make check' may have crashed with 32bit systems

dovecot was updated to 2.3.2: old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE while opening /proc/self/io. This may still cause security problems if the process is ptrace()d at the same time.
Instead, open it while still running as root.

doveadm: Added mailbox cache decision&remove commands. See doveadm-mailbox(1) man page for details.

doveadm: Added rebuild attachments command for rebuilding $HasAttachment or $HasNoAttachment flags for matching mails. See doveadm-rebuild(1) man page for details.

cassandra: Use fallback_consistency on more types of errors

lmtp proxy: Support outgoing SSL/TLS connections

lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.

submission: Add support for rawlog_dir

submission: Add submission_client_workarounds setting.

lua auth: Add password_verify() function and additional fields in auth request.

doveadm-server: TCP connections are hanging when there is a lot of network output. This especially caused hangs in dsync-replication.

Using multiple type=shared mdbox namespaces crashed

mail_fsync setting was ignored. It was always set to 'optimized'.

lua auth: Fix potential crash at deinit

SSL/TLS servers may have crashed if client disconnected during handshake.

SSL/TLS servers: Don't send extraneous certificates to client when alt certs are used.

lda, lmtp: Return-Path header without '

lda, lmtp: Unencoded UTF-8 in email address headers may assert-crash

lda: -f parameter didn't allow empty/null/domainless address

lmtp, submission: Message size limit was hard-coded to 40 MB.
Exceeding it caused the connection to get dropped during transfer.

lmtp: Fix potential crash when delivery fails at DATA stage

lmtp: login_greeting setting was ignored

Fix to work with OpenSSL v1.0.2f

systemd unit restrictions were too strict by default

Fix potential crashes when a lot of log output was produced

SMTP client may have assert-crashed when sending mail

IMAP COMPRESS: Send 'end of compression' marker when disconnecting.

cassandra: Fix consistency=quorum to work

dsync: Lock file generation failed if home directory didn't exist

Snippet generation for HTML mails didn't ignore &entities inside blockquotes, producing strange looking snippets.

imapc: Fix assert-crash if getting disconnected and after reconnection all mails in the selected mailbox are gone.

pop3c: Handle unexpected server disconnections without assert-crash

fts: Fixes to indexing mails via virtual mailboxes.

fts: If mails contained NUL characters, the text around it wasn't indexed.

Obsolete dovecot.index.cache offsets were sometimes used. Trying to fetch a field that was just added to cache file may not have always found it.

pigeonhole was updated to 0.5.2: Implement plugin for the a vendor-defined IMAP capability called 'FILTER=SIEVE'. It adds the ability to manually invoke Sieve filtering in IMAP. More information can be found in doc/plugins/imap_filter_sieve.txt.

The Sieve addess test caused an assertion panic for invalid addresses with UTF-8 codepoints in the localpart. Fixed by properly detecting invalid addresses with UTF-8 codepoints in the localpart and skipping these like other invalid addresses while iterating addresses for the address test.

Make the length of the subject header for the vacation response configurable and enforce the limit in UTF-8 codepoints rather than bytes. The subject header for a vacation response was statically truncated to 256 bytes, which is too limited for multi-byte UTF-8 characters.

Sieve editheader extension: Fix assertion panic occurring when it is used to manipulate a message header with a very large header field.

Properly abort execution of the sieve_discard script upon error.
Before, the LDA Sieve plugin attempted to execute the sieve_discard script when an error occurs. This can lead to the message being lost.

Fix the interaction between quota and the sieve_discard script. When quota was used together with a sieve_discard script, the message delivery did not bounce when the quota was exceeded.

Fix crash for over quota users

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a vulnerability in the dovecot IMAP/POP3 server.

A flaw in the TLS username handling could lead to an attacker logging in as anyone else in the system if both auth_ssl_{require_client,username_from}_cert were enabled.

For Debian 8 'Jessie', this issue has been fixed in dovecot version 1:2.2.13-12~deb8u5.

We recommend that you upgrade your dovecot packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3881-1 advisory.

    It was discovered that Dovecot incorrectly handled client certificates. A remote attacker in possession of     a valid certificate with an empty username field could possibly use this issue to impersonate other users.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Aki Tuomi (Open-Xchange Oy) reports :

Normally Dovecot is configured to authenticate imap/pop3/managesieve/submission clients using regular username/password combination. Some installations have also required clients to present a trusted SSL certificate on top of that. It's also possible to configure Dovecot to take the username from the certificate instead of from the user provided authentication. It's also possible to avoid having a password at all, only trusting the SSL certificate.

If the provided trusted SSL certificate is missing the username field, Dovecot should be failing the authentication. However, the earlier versions will take the username from the user provided authentication fields (e.g. LOGIN command). If there is no additional password verification, this allows the attacker to login as anyone else in the system.

This affects only installations using :

auth_ssl_require_client_cert = yes auth_ssl_username_from_cert = yes

Attacker must also have access to a valid trusted certificate without the ssl_cert_username_field in it. The default is commonName, which almost certainly exists in all certificates. This could happen for example if ssl_cert_username_field is a field that normally doesn't exist, and attacker has access to a web server's certificate (and key), which is signed with the same CA.

Attack can be migitated by having the certificates with proper Extended Key Usage, such as 'TLS Web Server' and 'TLS Web Server Client'.

Also, ssl_cert_username_field setting was ignored with external SMTP AUTH, because none of the MTAs (Postfix, Exim) currently send the cert_username field. This may have allowed users with trusted certificate to specify any username in the authentication. This does not apply to Dovecot Submission service.

halfdog discovered an authentication bypass vulnerability in the Dovecot email server. Under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing. If there is no additional password verification, this allows the attacker to login as anyone else in the system. Only installations using :

  - auth_ssl_require_client_cert = yes
  - auth_ssl_username_from_cert = yes

are affected by this flaw.

ID	Name	Product	Family	Severity
198627	RHEL 6 : dovecot (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198579	RHEL 5 : dovecot (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
180813	Oracle Linux 8 : dovecot (ELSA-2019-3467)	Nessus	Oracle Linux Local Security Checks	medium
180699	Oracle Linux 7 : dovecot (ELSA-2020-1062)	Nessus	Oracle Linux Local Security Checks	high
145614	CentOS 8 : dovecot (CESA-2019:3467)	Nessus	CentOS Local Security Checks	medium
144049	NewStart CGSL CORE 5.05 / MAIN 5.05 : dovecot Multiple Vulnerabilities (NS-SA-2020-0105)	Nessus	NewStart CGSL Local Security Checks	high
143982	NewStart CGSL CORE 5.04 / MAIN 5.04 : dovecot Multiple Vulnerabilities (NS-SA-2020-0071)	Nessus	NewStart CGSL Local Security Checks	high
139852	Amazon Linux 2 : dovecot (ALAS-2020-1473)	Nessus	Amazon Linux Local Security Checks	high
136624	Amazon Linux AMI : dovecot (ALAS-2020-1363)	Nessus	Amazon Linux Local Security Checks	high
135805	Scientific Linux Security Update : dovecot on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	high
135329	CentOS 7 : dovecot (RHSA-2020:1062)	Nessus	CentOS Local Security Checks	high
135038	RHEL 7 : dovecot (RHSA-2020:1062)	Nessus	Red Hat Local Security Checks	high
130542	RHEL 8 : dovecot (RHSA-2019:3467)	Nessus	Red Hat Local Security Checks	medium
125910	Fedora 30 : 1:dovecot (2019-9e004decea)	Nessus	Fedora Local Security Checks	high
125496	EulerOS 2.0 SP3 : dovecot (EulerOS-SA-2019-1569)	Nessus	Huawei Local Security Checks	high
124376	EulerOS 2.0 SP5 : dovecot (EulerOS-SA-2019-1280)	Nessus	Huawei Local Security Checks	high
124375	EulerOS 2.0 SP2 : dovecot (EulerOS-SA-2019-1279)	Nessus	Huawei Local Security Checks	high
124142	openSUSE Security Update : dovecot22 (openSUSE-2019-1220)	Nessus	SuSE Local Security Checks	high
124132	GLSA-201904-19 : Dovecot: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
123926	SUSE SLES12 Security Update : dovecot22 (SUSE-SU-2019:0900-1)	Nessus	SuSE Local Security Checks	high
122444	openSUSE Security Update : dovecot23 (openSUSE-2019-243)	Nessus	SuSE Local Security Checks	medium
122306	SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2019:0414-1)	Nessus	SuSE Local Security Checks	medium
122037	Debian DLA-1667-1 : dovecot security update	Nessus	Debian Local Security Checks	medium
121619	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Dovecot vulnerability (USN-3881-1)	Nessus	Ubuntu Local Security Checks	medium
121604	FreeBSD : mail/dovecot -- Suitable client certificate can be used to login as other user (1340fcc1-2953-11e9-bc44-a4badb296695)	Nessus	FreeBSD Local Security Checks	medium
121603	Debian DSA-4385-1 : dovecot - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2019-3814

medium

Tenable Plugins

high

high

medium

high

medium

high

high

high

high

high

high

high

medium

high

high

high

high

high

high

high

medium

medium

medium

medium

medium

medium