This bug was fixed in the package dovecot - 1:2.4.4+dfsg1-2ubuntu1
---------------
dovecot (1:2.4.4+dfsg1-2ubuntu1) stonking; urgency=medium
* Merge with Debian unstable (LP: #2154098). Remaining changes:
- d/rules: switch to -O2 (from -O3) on ppc64el to fix FTBFS (LP 2121250)
* Dropped changes:
- SECURITY UPDATE: safe filter issue when used with variable expansion
+ debian/patches/CVE-2026-27851.patch: lib-var-expand: Reset safe state
when
transfer is unset in src/lib-var-expand/test-var-expand.c, src/lib-var-
expand/var-expand.c.
+ CVE-2026-27851
[Fixed upstream 2.4.4]
- SECURITY UPDATE: fake SCRAM TLS channel binding via crafted base64
+ debian/patches/CVE-2026-33603.patch: login-common: Only accept base64 in
sasl in src/login-common/client-common-auth.c.
+ CVE-2026-33603
[Fixed upstream 2.4.4]
- SECURITY UPDATE: CPU time limits bypass via sieve script
+ debian/patches/CVE-2026-40016.patch: lib-sieve: Enforce CPU time limit
within :contains and :matches matcher loops in pigeonhole/src/lib-
sieve/mcht-contains.c, pigeonhole/src/lib-sieve/mcht-matches.c,
pigeonhole/src/lib-sieve/sieve-interpreter.c, pigeonhole/src/lib-
sieve/sieve-interpreter.h.
+ CVE-2026-40016
[Fixed upstream 2.4.4]
- SECURITY UPDATE: permission injection via IMAP SETACL command
+ debian/patches/CVE-2026-40020-pre1.patch: acl: Add acl_id_is_valid() in
src/plugins/acl/acl-rights.c, src/plugins/acl/acl-rights.h.
+ debian/patches/CVE-2026-40020.patch: imap-acl: Fail if ACL identifier is
invalid in src/plugins/imap-acl/imap-acl-plugin.c.
+ CVE-2026-40020
[Fixed upstream 2.4.4]
- SECURITY UPDATE: memory consumption via excessive bracing over IMAP
+ debian/patches/CVE-2026-42006.patch: lib-imap: Fix
imap_parser_params.list_count_limit to actually work in
src/lib-imap/imap-
parser.c, src/lib-imap/test-imap-parser.c.
+ CVE-2026-42006
[Fixed upstream 2.4.4]
- SECURITY UPDATE: Improper input validation
+ debian/patches/CVE-2025-59028.patch: [PATCH 01/24] auth: Don't
disconnect auth client when invalid base64 SASL input is received
+ CVE-2025-59028
[Fixed upstream 2.4.4]
- SECURITY UPDATE: Exposure of Sensitive Information to an Unauthorized
Actor
+ debian/patches/CVE-2025-59031.patch: [PATCH 02/24] fts: Remove
decode2text.sh
+ debian/rules: Remove decode2text.sh from it.
+ debian/dovecot-core.examples: Remove decode2text.sh from it.
+ CVE-2025-59031
[Fixed upstream 2.4.4]
- SECURITY UPDATE: Improper Input Validation
+ debian/patches/CVE-2025-59032.patch: managesieve-login: Fix crash
when command didn't finish on the first call
+ CVE-2025-59032
[Fixed upstream 2.4.4]
- SECURITY UPDATE: SQL/LDAP Injection
+ debian/patches/CVE-2026-24031-27860-1.patch: [PATCH 04/24] auth:
Make struct settings_get_params params const
+ debian/patches/CVE-2026-24031-27860-2.patch: [PATCH 05/24] auth:
passdb/userdb ldap - Fix escaping ldap filter, base and bind_userdn
+ debian/patches/CVE-2026-24031-27860-3.patch: [PATCH 06/24] lib-
settings: settings_get_params() - Fix using provided escape_func
+ debian/patches/CVE-2026-24031-27860-4.patch: [PATCH 07/24] auth:
test-auth - Run Lua unit tests even when building Lua as plugin
+ debian/patches/CVE-2026-24031-27860-5.patch: [PATCH 08/24] auth:
Rewrite ldap_escape() with a unit test
+ debian/patches/CVE-2026-24031-27860-6.patch: [PATCH 09/24] auth:
passdb sql - Fix escaping for set_credentials()
+ debian/patches/CVE-2026-24031-27860-7.patch: [PATCH 10/24] auth:
userdb sql - Fix escaping for user iteration
+ debian/patches/CVE-2026-24031-27860-8.patch: [PATCH 11/24] lib-
var-expand: Add "safe" filter to prevent escaping output
+ CVE-2026-24031
+ CVE-2026-27860
[Fixed upstream 2.4.4]
- SECURITY UPDATE: Authentication Bypass
+ debian/patches/CVE-2026-27855-1.patch: [PATCH 21/24] auth: cache -
Use translated username in auth_cache_remove()
+ debian/patches/CVE-2026-27855-2.patch: [PATCH 22/24] auth: Move
passdb event lifecycle handling to
auth_request_passdb_event_(begin|end)
+ debian/patches/CVE-2026-27855-3.patch: [PATCH 23/24] auth:
Initialize set_credentials event properly
+ debian/patches/CVE-2026-27855-4.patch: [PATCH 24/24] auth: passdb-
sql - Require update_query to be set when used
+ CVE-2026-27855
[Fixed upstream 2.4.4]
- SECURITY UPDATE: Improper Authentication
+ debian/patches/CVE-2026-27856-1.patch: [PATCH 16/24] doveadm:
client-connection - Use timing safe credential check
+ debian/patches/CVE-2026-27856-2.patch: [PATCH 17/24] doveadm: Use
datastack for temporary b64 value
+ debian/patches/CVE-2026-27856-3.patch: [PATCH 18/24] doveadm:
client-connection - Get API key from per-connection settings
+ CVE-2026-27856
[Fixed upstream 2.4.4]
- SECURITY UPDATE: Uncontrolled Resource Consumption
+ debian/patches/CVE-2026-27857-1.patch: [PATCH 1/2] plugins: imap-
filter-sieve: imap-filter-sieve - Adjust to imap_parser_create() API
change
+ debian/patches/CVE-2026-27857-2.patch: [PATCH 12/24] lib-imap,
global: Add params parameter to imap_parser_create()
+ debian/patches/CVE-2026-27857-3.patch: [PATCH 13/24] lib-imap: Add
imap_parser_params.list_count_limit
+ debian/patches/CVE-2026-27857-4.patch: [PATCH 14/24] imap-login:
Limit the number of open IMAP parser lists
+ debian/patches/CVE-2026-27857-5.patch: [PATCH 15/24] global: Use
const for struct imap_parser_params params
+ CVE-2026-27857
[Fixed upstream 2.4.4]
- SECURITY UPDATE: Uncontrolled Resource Consumption
+ debian/patches/CVE-2026-27858.patch: [PATCH 2/2] managesieve-
login: Verify AUTHENTICATE initial response size isn't too large
+ CVE-2026-27858
[Fixed upstream 2.4.4]
- SECURITY UPDATE: Uncontrolled Resource Consumption
+ debian/patches/CVE-2026-27859.patch: [PATCH 03/24] lib-mail: Limit
the number of RFC2231 parameters that can be parsed
+ CVE-2026-27859
[Fixed upstream 2.4.4]
* New changes:
- fix test segfault with openssl 4.0 (LP: #2154849)
d/p/openssl4-dont-call-openssl-cleanup.patch
- d/{control,rules}: Revert migration of dovecot-mysql to dovecot-mariadb
As Ubuntu is still assessing if this is the way going forward.
- d/t/mariadb/00_setup: switch to unix_socket auth method
this is needed since we reverted the migration to mariadb
and might be reconsidered in the next releases.
(LP: #2162829)
-- Hector Cao <[email protected]> Fri, 14 Aug 2026 16:29:17
+0200
** Changed in: dovecot (Ubuntu Stonking)
Status: Triaged => Fix Released
** CVE added: https://cve.org/CVERecord?id=CVE-2025-59028
** CVE added: https://cve.org/CVERecord?id=CVE-2025-59031
** CVE added: https://cve.org/CVERecord?id=CVE-2025-59032
** CVE added: https://cve.org/CVERecord?id=CVE-2026-24031
** CVE added: https://cve.org/CVERecord?id=CVE-2026-27851
** CVE added: https://cve.org/CVERecord?id=CVE-2026-27855
** CVE added: https://cve.org/CVERecord?id=CVE-2026-27856
** CVE added: https://cve.org/CVERecord?id=CVE-2026-27857
** CVE added: https://cve.org/CVERecord?id=CVE-2026-27858
** CVE added: https://cve.org/CVERecord?id=CVE-2026-27859
** CVE added: https://cve.org/CVERecord?id=CVE-2026-27860
** CVE added: https://cve.org/CVERecord?id=CVE-2026-33603
** CVE added: https://cve.org/CVERecord?id=CVE-2026-40016
** CVE added: https://cve.org/CVERecord?id=CVE-2026-40020
** CVE added: https://cve.org/CVERecord?id=CVE-2026-42006
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162829
Title:
autopkgtests fail for mariadb server backend for users storage
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/dovecot/+bug/2162829/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
