CVE-2019-3814

It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users.

It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users.

CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field (ssl_cert_username_field), under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing.

This update for dovecot23 fixes the following issues:

dovecot was updated to 2.3.3 release, bringing lots of bugfixes (bsc#1124356).

Also the following security issue was fixed:

• CVE-2019-3814: A vulnerability in Dovecot related to SSL client certificate authentication was fixed (bsc#1123022)

The package changes:

Updated pigeonhole to 0.5.3:

• Fix assertion panic occurring when managesieve service fails to open INBOX while saving a Sieve script. This was caused by a lack of cleanup after failure.
• Fix specific messages causing an assert panic with actions that compose a reply (e.g. vacation). With some rather weird input from the original message, the header folding algorithm (as used for composing the References header for the reply) got confused, causing the panic.
• IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command parsing. After finishing reading the Sieve script, the command parsing sometimes didn't continue with the search arguments. This is a time- critical bug that likely only occurs when the Sieve script is sent in the next TCP frame.

dovecot23 was updated to 2.3.3:

• doveconf hides more secrets now in the default output.
• ssl_dh setting is no longer enforced at startup. If it's not set and non-ECC DH key exchange happens, error is logged and client is disconnected.
• Added log_debug=<filter> setting.
• Added log_core_filter=<log filter> setting.
• quota-clone: Write to dict asynchronously
• --enable-hardening attempts to use retpoline Spectre 2 mitigations
• lmtp proxy: Support source_ip passdb extra field.
• doveadm stats dump: Support more fields and output stddev by default.
• push-notification: Add SSL support for OX backend.
• NUL bytes in mail headers can cause truncated replies when fetched.
• director: Conflicting host up/down state changes may in some rare situations ended up in a loop of two directors constantly overwriting each others' changes.
• director: Fix hang/crash when multiple doveadm commands are being handled concurrently.
• director: Fix assert-crash if doveadm disconnects too early
• virtual plugin: Some searches used 100% CPU for many seconds
• dsync assert-crashed with acl plugin in some situations. (bsc#1119850)
• mail_attachment_detection_options=add-flags-on-save assert-crashed with some specific Sieve scripts.
• Mail snippet generation crashed with mails containing invalid Content-Type:multipart header.
• Log prefix ordering was different for some log lines.
• quota: With noenforcing option current quota usage wasn't updated.
• auth: Kerberos authentication against Samba assert-crashed.
• stats clients were unnecessarily chatty with the stats server.
• imapc: Fixed various assert-crashes when reconnecting to server.
• lmtp, submission: Fix potential crash if client disconnects while handling a command.
• quota: Fixed compiling with glibc-2.26 / support libtirpc.
• fts-solr: Empty search values resulted in 400 Bad Request errors
• fts-solr: default_ns parameter couldn't be used
• submission server crashed if relay server returned over 7 lines in a reply (e.g. to EHLO)

dovecot was updated to 2.3.2.1:

• SSL/TLS servers may have crashed during client disconnection
• lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have sometimes assert-crashed.
• v2.3.2: 'make check' may have crashed with 32bit systems

dovecot was updated to 2.3.2:

• old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE while opening /proc/self/io. This may still cause security problems if the process is ptrace()d at the same time. Instead, open it while still running as root.
• doveadm: Added mailbox cache decision&remove commands. See doveadm-mailbox(1) man page for details.
• doveadm: Added rebuild attachments command for rebuilding $HasAttachment or $HasNoAttachment flags for matching mails. See doveadm-rebuild(1) man page for details.
• cassandra: Use fallback_consistency on more types of errors
• lmtp proxy: Support…

These are all security issues fixed in the dovecot23-2.3.16-1.6 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the dovecot24-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for dovecot23 fixes the following issues:

dovecot was updated to 2.3.3 release, bringing lots of bugfixes (bsc#1124356).

Also the following security issue was fixed:

• CVE-2019-3814: A vulnerability in Dovecot related to SSL client certificate authentication was fixed (bsc#1123022)

The package changes:

Updated pigeonhole to 0.5.3:

• Fix assertion panic occurring when managesieve service fails to open INBOX while saving a Sieve script. This was caused by a lack of cleanup after failure.
• Fix specific messages causing an assert panic with actions that compose a reply (e.g. vacation). With some rather weird input from the original message, the header folding algorithm (as used for composing the References header for the reply) got confused, causing the panic.
• IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command parsing. After finishing reading the Sieve script, the command parsing sometimes didn't continue with the search arguments. This is a time- critical bug that likely only occurs when the Sieve script is sent in the next TCP frame.

dovecot23 was updated to 2.3.3:

• doveconf hides more secrets now in the default output.
• ssl_dh setting is no longer enforced at startup. If it's not set and non-ECC DH key exchange happens, error is logged and client is disconnected.
• Added log_debug=<filter> setting.
• Added log_core_filter=<log filter> setting.
• quota-clone: Write to dict asynchronously
• --enable-hardening attempts to use retpoline Spectre 2 mitigations
• lmtp proxy: Support source_ip passdb extra field.
• doveadm stats dump: Support more fields and output stddev by default.
• push-notification: Add SSL support for OX backend.
• NUL bytes in mail headers can cause truncated replies when fetched.
• director: Conflicting host up/down state changes may in some rare situations ended up in a loop of two directors constantly overwriting each others' changes.
• director: Fix hang/crash when multiple doveadm commands are being handled concurrently.
• director: Fix assert-crash if doveadm disconnects too early
• virtual plugin: Some searches used 100% CPU for many seconds
• dsync assert-crashed with acl plugin in some situations. (bsc#1119850)
• mail_attachment_detection_options=add-flags-on-save assert-crashed with some specific Sieve scripts.
• Mail snippet generation crashed with mails containing invalid Content-Type:multipart header.
• Log prefix ordering was different for some log lines.
• quota: With noenforcing option current quota usage wasn't updated.
• auth: Kerberos authentication against Samba assert-crashed.
• stats clients were unnecessarily chatty with the stats server.
• imapc: Fixed various assert-crashes when reconnecting to server.
• lmtp, submission: Fix potential crash if client disconnects while handling a command.
• quota: Fixed compiling with glibc-2.26 / support libtirpc.
• fts-solr: Empty search values resulted in 400 Bad Request errors
• fts-solr: default_ns parameter couldn't be used
• submission server crashed if relay server returned over 7 lines in a reply (e.g. to EHLO)

dovecot was updated to 2.3.2.1:

• SSL/TLS servers may have crashed during client disconnection
• lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have sometimes assert-crashed.
• v2.3.2: 'make check' may have crashed with 32bit systems

dovecot was updated to 2.3.2:

• old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE while opening /proc/self/io. This may still cause security problems if the process is ptrace()d at the same time. Instead, open it while still running as root.
• doveadm: Added mailbox cache decision&remove commands. See doveadm-mailbox(1) man page for details.
• doveadm: Added rebuild attachments command for rebuilding $HasAttachment or $HasNoAttachment flags for matching mails. See doveadm-rebuild(1) man page for details.
• cassandra: Use fallback_consistency on more types of errors
• lmtp proxy: Support…

This update for dovecot22 fixes the following issues:

Security issues fixed:

• CVE-2019-7524: Fixed an improper file handling which could result in stack overflow allowing local root escalation (bsc#1130116).
• CVE-2019-3814: Fixed a vulnerability related to SSL client certificate authentication (bsc#1123022).

Other issue fixed:

• Fixed handling of command continuation(bsc#1111789)

It was discovered that Dovecot incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users.