Every CVE Search/ Get API key

CVE-2011-4318

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the...

5.8 MediumFix available

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.

Exploit likelihood

1.32%Down 0.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.8

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.

Record
CVE-2011-4318
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.

Record
CVE-2011-4318
Updated
2026-11-02
EUVDEUVD-2011-4252 No score

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.

Record
EUVD-2011-4252
Updated
2026-11-03
GitHub AdvisoriesGHSA-w2rf-p589-jpp8 No score

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the...

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.

Record
GHSA-w2rf-p589-jpp8
Weakness
CWE-20
Updated
2026-11-02
OSV No score

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.

Record
CVE-2011-4318
Updated
2026-11-02
OSVDEBIAN-CVE-2011-4318 No score

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.

Record
DEBIAN-CVE-2011-4318
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dovecot
Debian:12
 before 1:2.0.18-1
1:2.0.18-1
dovecot
Debian:13
 before 1:2.0.18-1
1:2.0.18-1
dovecot
Debian:14
 before 1:2.0.18-1
1:2.0.18-1
dovecot
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:2.0.9-5.el6
1:2.0.9-5.el6
dovecot-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:2.0.9-5.el6
1:2.0.9-5.el6
dovecot-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:2.0.9-5.el6
1:2.0.9-5.el6
dovecot-mysql
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:2.0.9-5.el6
1:2.0.9-5.el6
dovecot-pgsql
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:2.0.9-5.el6
1:2.0.9-5.el6
dovecot-pigeonhole
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 1:2.0.9-5.el6
1:2.0.9-5.el6
dovecot
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:2.0.9-5.el6
1:2.0.9-5.el6
Show 5 moreShow less
Affected packages
PackageAffectedFixed
dovecot-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:2.0.9-5.el6
1:2.0.9-5.el6
dovecot-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:2.0.9-5.el6
1:2.0.9-5.el6
dovecot-mysql
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:2.0.9-5.el6
1:2.0.9-5.el6
dovecot-pgsql
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:2.0.9-5.el6
1:2.0.9-5.el6
dovecot-pigeonhole
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 1:2.0.9-5.el6
1:2.0.9-5.el6

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-4318 is a medium vulnerability (CVSS 5.8) in Dovecot, published March 7, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.32%, the 70th percentile. Fixed in dovecot 1:2.0.18-1.

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open