Debian Security Advisory

DLA-1667-1 dovecot -- LTS security update

Date Reported:
07 Feb 2019
Affected Packages:
Security database references:
In Mitre's CVE dictionary: CVE-2019-3814.
More information:

It was discovered that there was a vulnerability in the dovecot IMAP/POP3 server.

A flaw in the TLS username handling could lead to an attacker logging in as anyone else in the system if both auth_ssl_{require_client,username_from}_cert were enabled.

For Debian 8 Jessie, this issue has been fixed in dovecot version 1:2.2.13-12~deb8u5.

We recommend that you upgrade your dovecot packages.