Debian alert DLA-4556-1 (dovecot)

From:
             
 
Guilhem Moulin <guilhem@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4556-1] dovecot security update
Date:
             
 
Fri, 01 May 2026 07:11:43 +0200
Message-ID:
             
 
<afQ2DwxFPadojJqD@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4556-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Guilhem Moulin
May 01, 2026                                  https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : dovecot
Version        : 1:2.3.13+dfsg1-2+deb11u3
CVE ID         : CVE-2025-59031 CVE-2025-59032 CVE-2026-0394 CVE-2026-27855 
                 CVE-2026-27856 CVE-2026-27857 CVE-2026-27858 CVE-2026-27859

Multiple vulnerabilities were discovered in dovecot, a POP3/IMAP server,
which could lead to Denial of Service, information leak, path traversal,
authentication bypass, replay attacks or timing side channel attacks.

CVE-2025-59031

    The decode2text.sh example script, which was installed into
    dovecot-core/examples, was found handle zip-style attachment in an
    unsafe manner.  In particular, OOXML extraction may follow symlinks
    and read unintended files during indexing.  The script is no longer
    installed.

CVE-2025-59032

    It was found that the ManageSieve AUTHENTICATE command crashes the
    ManageSieve service when using literal as SASL initial response,
    leading to Denial of Service.

CVE-2026-0394

    A pass traversal vulnerability was discovered in the passwd-file
    passdb/userdb when dovecot has been configured to use per-domain
    passwd files, allowing inadvertently reading /etc/passwd in some
    situations.  If this file contains passwords, it can be used to
    authenticate wrongly, or if this is userdb, it can incorrectly make
    system users appear valid users.

CVE-2026-27855

    The OTP authentication driver was found to be vulnerable to replay
    attack if auth cache is enabled the and username is altered in
    passdb.  An attacker able to observe an OTP exchange is therefore
    able to impersonate the user.

CVE-2026-27856

    Doveadm credentials were not checked using timing-safe checking
    functions.  An attacker can exploit this issue to discover configured
    credentials, leading into full access to the affected component.

CVE-2026-27857

    It was discovered that sending excessive parenthesis caused the
    imap-login process to use excessive memory, leading to Denial of
    Service.

CVE-2026-27858

    It was discovered that the managesieve-login process could allocate
    large amount of memory during authentication via specifically crafted
    message, leading to Denial of Service.

CVE-2026-27859

    It was discovered that excessive RFC 2231 MIME parameters in email
    would cause excessive CPU usage, which could lead to Denial of
    Service.  Dovecot now limits the number of parameters to process.

For Debian 11 bullseye, these problems have been fixed in version
1:2.3.13+dfsg1-2+deb11u3.

We recommend that you upgrade your dovecot packages.

For the detailed security status of dovecot please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/dovecot

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmn0Ng0ACgkQ05pJnDwh
pVL8AxAArZwtH9ixbHTkQUU55C7GXoSOC8P15oMkzNihmWIUolbxpQy2ut16WEMs
sJg/tm1u1g5n/e+sO+haDmuNSOIFhluwj+1fvTvcFkD33GwM3QJnGLlo5iaUuyNv
2gqvksRAjACNMZRX9snYWbkVFHCAvqihYjeBi3BhmqWbD71q8QmPP2Q+8xrQVAhu
/XYVZDXX5K0nEYLwhEswHfkMemBpsMO2bxb9S85zBAQpA7o1LNlv3ap8TqNZARQn
LRDoZDyk78/bg+Cfx3LOaHa8coqG2wSW6FuPVHeC130qaLOyvPXLzavli3tiOt6N
VWPRxU9pwBQ9j89Jk/xbph3xcxaOj7uWKyXa2SInj3vRh5FKlwV+t20TsxV0+MbE
0OyIYqWX3CNUDoTaxsL+nErkRQPvLg3Wi8nXJfveT00PnzJfPKLE3wVXDLmNXLK4
qPSsD5fdyO7I56/Co8CUXNMc6Qq3tzKBMrYZZmIlBHJ+TFfTHjV8NIC529D1sVQs
ddRJ2u5kNbzGLT2vWZsp/Y50To83cjcxZaKk9GCt+NwApXQTTF8CWj9bu5uBpXTw
/yR+KUv5QmH/JWyfRIj3Hhd2tm+pMF+tjh07mP4w+XI0PEQAFxCtJcCkhvPFZDnR
/Uoyj6sXG6kNIgLgKbPt2SNYao3RoZ2+9JBkRILZhe0Ht5PgZMA=
=UP0r
-----END PGP SIGNATURE-----