Описание
None None None No publicly available exploits are known.
A flaw was found in Dovecot. A remote attacker with high attack complexity could exploit this vulnerability to gain access to sensitive information and modify data without requiring any user interaction or privileges.
Отчет
This vulnerability is rated Important rather than Moderate because an unauthenticated network attacker could execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data modification and disclosure of sensitive mailbox information. On Red Hat Enterprise Linux, Dovecot is not active by default and relies on standard system authentication methods unless explicitly configured otherwise. Consequently, only deployments actively configured to use MySQL or MariaDB database backends with multi-byte character handling are vulnerable.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | dovecot | Out of support scope | ||
| Red Hat Enterprise Linux 7 | dovecot | Affected | ||
| Red Hat Enterprise Linux 10 | dovecot | Fixed | RHSA-2026:79371 | 08.10.2026 |
| Red Hat Enterprise Linux 8 | dovecot | Fixed | RHSA-2026:76763 | 06.10.2026 |
| Red Hat Enterprise Linux 9 | dovecot | Fixed | RHSA-2026:80825 | 12.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.4 High
CVSS3
EPSS
7.4 High
CVSS3