Описание
Security update for dovecot22
This update for dovecot22 fixes the following issues:
Security issues fixed:
- CVE-2019-7524: Fixed an improper file handling which could result in stack overflow allowing local root escalation (bsc#1130116).
- CVE-2019-3814: Fixed a vulnerability related to SSL client certificate authentication (bsc#1123022).
Other issue fixed:
- Fixed handling of command continuation (bsc#1111789).
This update was imported from the SUSE:SLE-12:Update update project.
Список пакетов
openSUSE Leap 42.3
dovecot22-2.2.31-2.12.1
dovecot22-backend-mysql-2.2.31-2.12.1
dovecot22-backend-pgsql-2.2.31-2.12.1
dovecot22-backend-sqlite-2.2.31-2.12.1
dovecot22-devel-2.2.31-2.12.1
dovecot22-fts-2.2.31-2.12.1
dovecot22-fts-lucene-2.2.31-2.12.1
dovecot22-fts-solr-2.2.31-2.12.1
dovecot22-fts-squat-2.2.31-2.12.1
Ссылки
- E-Mail link for openSUSE-SU-2019:1220-1
- SUSE Security Ratings
Описание
It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users.
Затронутые продукты
openSUSE Leap 42.3:dovecot22-2.2.31-2.12.1
openSUSE Leap 42.3:dovecot22-backend-mysql-2.2.31-2.12.1
openSUSE Leap 42.3:dovecot22-backend-pgsql-2.2.31-2.12.1
openSUSE Leap 42.3:dovecot22-backend-sqlite-2.2.31-2.12.1
Ссылки
- CVE-2019-3814
- SUSE Bug 1123022
Описание
In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components.
Затронутые продукты
openSUSE Leap 42.3:dovecot22-2.2.31-2.12.1
openSUSE Leap 42.3:dovecot22-backend-mysql-2.2.31-2.12.1
openSUSE Leap 42.3:dovecot22-backend-pgsql-2.2.31-2.12.1
openSUSE Leap 42.3:dovecot22-backend-sqlite-2.2.31-2.12.1
Ссылки
- CVE-2019-7524
- SUSE Bug 1130116