CVSROOT: /cvs
Module name: ports
Changes by: [email protected] 2019/02/08 06:34:40
Modified files:
mail/dovecot : Makefile distinfo
Log message:
update to Dovecot 2.3.4.1, fixing some issues with client certificates.
ok brad (maintainer)
* CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted
certificate with missing username field (ssl_cert_username_field), under
some configurations Dovecot mistakenly trusts the username provided via
authentication instead of failing.
* ssl_cert_username_field setting was ignored with external SMTP
AUTH, because none of the MTAs (Postfix, Exim) currently send the
cert_username field. This may have allowed users with trusted
certificate to specify any username in the authentication. This bug
didn't affect Dovecot's Submission service.
