Guilhem Moulin pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
5a492fae by Guilhem Moulin at 2026-09-27T21:21:27+02:00
CVE-2026-42392/dovecot: Triage for bookworm
And add link to commit referencing the issue
- - - - -
2b28f106 by Guilhem Moulin at 2026-09-27T21:21:28+02:00
CVE-2026-40016/dovecot: Drop incorrect bullseye triaging
This reverts 63da12e856d53905f07acb2a6782c01f67ce8ad3. Sieve resource
usage tracking was added in 2.3.15 as a fix for CVE-2020-28200, so the
resource limit bypass don't affect versions earlier versions for which
the fix was not backported. This should therefore be <not-affected>
instead. Since bullseye is now ELTS, drop the the trigage here so it
can be set in the ELTS tracker.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -37215,8 +37215,10 @@ CVE-2026-42393 (The comparison used for the doveadm
password and API key is not
NOTE: Fixed by:
https://github.com/dovecot/core/commit/647e76a865ba173f6182e211c57ec3c2942a6b04
CVE-2026-42392 (An attacker that has valid credentials can send an invalid
IMAP URLFET ...)
- dovecot 1:2.4.5+dfsg1-1 (bug #1146018)
+ [bookworm] - dovecot <not-affected> (Vulnerable code not present,
introduced in 2.4.0)
NOTE:
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html#cve-2026-42392-imap-urlauth-leaks-memory-into-user-visible-error-messages
NOTE: Fixed by:
https://github.com/dovecot/core/commit/48d8141049f7150a0469a4efe68669fbf8bcbb24
+ NOTE: Introduced with:
https://github.com/dovecot/core/commit/bb193c273e63ffa42c5c0b51ecd8860398e3beab
(2.4.0)
CVE-2026-42391 (An unauthenticated attacker can send an IMAP ID command with a
very la ...)
- dovecot 1:2.4.5+dfsg1-1 (bug #1146018)
NOTE:
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html#cve-2026-42391-imap-pre-login-memory-cpu-growth-with-id-command
@@ -136236,7 +136238,6 @@ CVE-2026-40020 (Attacker can use the IMAP SETACL
command to inject the anyone pe
CVE-2026-40016 (Attacker can upload a malicious Sieve script over ManageSieve
service ...)
{DSA-6313-1}
- dovecot 1:2.4.4+dfsg1-1 (bug #1136444)
- [bullseye] - dovecot <ignored> (Minor issue, backport is too disruptive)
NOTE: https://www.openwall.com/lists/oss-security/2026/05/12/6
NOTE: Fixed by:
https://github.com/dovecot/pigeonhole/commit/5b0ed9d1034c023d3daf218b6b8656f0cdd383dc
(2.4.4)
CVE-2026-3604 (The WP SEO Structured Data Schema plugin for WordPress is
vulnerable t ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/883f25aae555101ed9d9486ec3e565e66064b84a...2b28f1065d0988e72fe5d12ff038b50919ad6cb0
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/883f25aae555101ed9d9486ec3e565e66064b84a...2b28f1065d0988e72fe5d12ff038b50919ad6cb0
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
