{"id":"CVE-2019-11500","aliases":["ALPINE-CVE-2019-11500","DEBIAN-CVE-2019-11500","DLA-1901-1","DSA-4510-1","EUVD-2019-3173","GHSA-mqm8-r3v6-8mmv","MGASA-2019-0261","RHSA-2019:2822","RHSA-2019:2836","RHSA-2019:2885","SUSE-SU-2019:2454-1","SUSE-SU-2019:2514-1","UBUNTU-CVE-2019-11500","USN-4110-1","USN-4110-2","USN-4110-3","USN-4110-4","openSUSE-SU-2019:2278-1","openSUSE-SU-2019:2281-1","openSUSE-SU-2024:10726-1","openSUSE-SU-2025:14715-1"],"status":"published","title":"In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol...","description":"In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.62324,"percentile":0.99191,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2019-08-28T00:00:00Z","modified":"2026-10-24T10:30:39Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"dovecot","fixed_in":["2.2.36.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"dovecot","fixed_in":["2.3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"dovecot","fixed_in":["1:2.3.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dovecot","fixed_in":["1:2.3.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dovecot","fixed_in":["1:2.3.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"dovecot","fixed_in":["1:2.2.13-12~deb8u7"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"dovecot","fixed_in":["1:2.2.27-3+deb9u5"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"dovecot","fixed_in":["1:2.3.4.1-5+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"dovecot","fixed_in":["2.2.36.4-1.mga6"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"dovecot","fixed_in":["2.3.7.2-1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot","fixed_in":["1:2.2.36-5.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-debuginfo","fixed_in":["1:2.2.36-5.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-debugsource","fixed_in":["1:2.2.36-5.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-mysql","fixed_in":["1:2.2.36-5.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-mysql-debuginfo","fixed_in":["1:2.2.36-5.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pgsql","fixed_in":["1:2.2.36-5.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pgsql-debuginfo","fixed_in":["1:2.2.36-5.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pigeonhole-debuginfo","fixed_in":["1:2.2.36-5.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot","fixed_in":["1:2.2.36-5.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-debuginfo","fixed_in":["1:2.2.36-5.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-debugsource","fixed_in":["1:2.2.36-5.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-devel","fixed_in":["1:2.2.36-5.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-mysql-debuginfo","fixed_in":["1:2.2.36-5.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-pgsql-debuginfo","fixed_in":["1:2.2.36-5.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-pigeonhole-debuginfo","fixed_in":["1:2.2.36-5.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"dovecot","fixed_in":["1:2.2.36-3.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"dovecot-debuginfo","fixed_in":["1:2.2.36-3.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"dovecot-mysql","fixed_in":["1:2.2.36-3.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"dovecot-pgsql","fixed_in":["1:2.2.36-3.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"dovecot-pigeonhole","fixed_in":["1:2.2.36-3.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"dovecot-devel","fixed_in":["1:2.2.36-3.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"dovecot","fixed_in":["1:2.2.36-3.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"dovecot-debuginfo","fixed_in":["1:2.2.36-3.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"dovecot-mysql","fixed_in":["1:2.2.36-3.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"dovecot-pgsql","fixed_in":["1:2.2.36-3.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"dovecot-pigeonhole","fixed_in":["1:2.2.36-3.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"dovecot-devel","fixed_in":["1:2.2.36-3.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"dovecot","fixed_in":["1:2.0.9-22.el6_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"dovecot-debuginfo","fixed_in":["1:2.0.9-22.el6_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"dovecot-mysql","fixed_in":["1:2.0.9-22.el6_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"dovecot-pgsql","fixed_in":["1:2.0.9-22.el6_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"dovecot-pigeonhole","fixed_in":["1:2.0.9-22.el6_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"dovecot-devel","fixed_in":["1:2.0.9-22.el6_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"dovecot","fixed_in":["1:2.0.9-22.el6_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"dovecot-debuginfo","fixed_in":["1:2.0.9-22.el6_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"dovecot-mysql","fixed_in":["1:2.0.9-22.el6_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"dovecot-pgsql","fixed_in":["1:2.0.9-22.el6_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"dovecot-pigeonhole","fixed_in":["1:2.0.9-22.el6_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"dovecot-devel","fixed_in":["1:2.0.9-22.el6_10.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 5","package":"dovecot22","fixed_in":["2.2.31-19.17.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dovecot","fixed_in":["1:2.2.9-1ubuntu2.6+esm1","1:2.2.9-1ubuntu2.6+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","fixed_in":["1:2.2.22-1ubuntu2.11","1:2.2.22-1ubuntu2.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"dovecot","fixed_in":["1:2.2.33.2-1ubuntu4.4","1:2.2.33.2-1ubuntu4.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.2.36.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.7.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.7.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.7.2-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.13-12~deb8u7"}]}],"versions":["1:2.2.13-11","1:2.2.13-12~deb8u1","1:2.2.13-12~deb8u2","1:2.2.13-12~deb8u3","1:2.2.13-12~deb8u4","1:2.2.13-12~deb8u5","1:2.2.13-12~deb8u6"]},{"source":"osv","ecosystem":"Debian:9","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.27-3+deb9u5"}]}],"versions":["1:2.2.27-3","1:2.2.27-3+deb9u1","1:2.2.27-3+deb9u2","1:2.2.27-3+deb9u2~bpo8+1","1:2.2.27-3+deb9u3","1:2.2.27-3+deb9u4"]},{"source":"osv","ecosystem":"Debian:10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.4.1-5+deb10u1"}]}],"versions":["1:2.3.4.1-5","1:2.3.4.1-5+deb10u1~bpo9+1"]},{"source":"osv","ecosystem":"Mageia:6","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.36.4-1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.7.2-1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-5.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-5.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-5.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-5.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-5.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-5.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-5.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-5.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-5.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-5.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-5.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-5.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-5.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-5.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-5.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-3.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-3.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-3.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-3.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-3.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-3.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-3.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-3.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-3.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-3.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-3.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.36-3.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-22.el6_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-22.el6_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-22.el6_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-22.el6_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-22.el6_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-22.el6_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-22.el6_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-22.el6_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-22.el6_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-22.el6_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-22.el6_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.9-22.el6_10.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.9-1ubuntu2.6+esm1"}]}],"versions":["1:2.1.7-7ubuntu3","1:2.2.9-1ubuntu1","1:2.2.9-1ubuntu2","1:2.2.9-1ubuntu2.1","1:2.2.9-1ubuntu2.3","1:2.2.9-1ubuntu2.4","1:2.2.9-1ubuntu2.5","1:2.2.9-1ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.22-1ubuntu2.11"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2","1:2.2.22-1ubuntu2.3","1:2.2.22-1ubuntu2.4","1:2.2.22-1ubuntu2.6","1:2.2.22-1ubuntu2.7","1:2.2.22-1ubuntu2.8","1:2.2.22-1ubuntu2.9","1:2.2.22-1ubuntu2.10"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.33.2-1ubuntu4.4"}]}],"versions":["1:2.2.27-3ubuntu1","1:2.2.33.2-1ubuntu1","1:2.2.33.2-1ubuntu2","1:2.2.33.2-1ubuntu3","1:2.2.33.2-1ubuntu4","1:2.2.33.2-1ubuntu4.1","1:2.2.33.2-1ubuntu4.2","1:2.2.33.2-1ubuntu4.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.22-1ubuntu2.11"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2","1:2.2.22-1ubuntu2.3","1:2.2.22-1ubuntu2.4","1:2.2.22-1ubuntu2.6","1:2.2.22-1ubuntu2.7","1:2.2.22-1ubuntu2.8","1:2.2.22-1ubuntu2.9","1:2.2.22-1ubuntu2.10"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.33.2-1ubuntu4.4"}]}],"versions":["1:2.2.27-3ubuntu1","1:2.2.33.2-1ubuntu1","1:2.2.33.2-1ubuntu2","1:2.2.33.2-1ubuntu3","1:2.2.33.2-1ubuntu4","1:2.2.33.2-1ubuntu4.1","1:2.2.33.2-1ubuntu4.2","1:2.2.33.2-1ubuntu4.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.9-1ubuntu2.6+esm1"}]}],"versions":["1:2.1.7-7ubuntu3","1:2.2.9-1ubuntu1","1:2.2.9-1ubuntu2","1:2.2.9-1ubuntu2.1","1:2.2.9-1ubuntu2.3","1:2.2.9-1ubuntu2.4","1:2.2.9-1ubuntu2.5","1:2.2.9-1ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.22-1ubuntu2.12"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2","1:2.2.22-1ubuntu2.3","1:2.2.22-1ubuntu2.4","1:2.2.22-1ubuntu2.6","1:2.2.22-1ubuntu2.7","1:2.2.22-1ubuntu2.8","1:2.2.22-1ubuntu2.9","1:2.2.22-1ubuntu2.10","1:2.2.22-1ubuntu2.11"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.33.2-1ubuntu4.5"}]}],"versions":["1:2.2.27-3ubuntu1","1:2.2.33.2-1ubuntu1","1:2.2.33.2-1ubuntu2","1:2.2.33.2-1ubuntu3","1:2.2.33.2-1ubuntu4","1:2.2.33.2-1ubuntu4.1","1:2.2.33.2-1ubuntu4.2","1:2.2.33.2-1ubuntu4.3","1:2.2.33.2-1ubuntu4.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.9-1ubuntu2.6+esm2"}]}],"versions":["1:2.1.7-7ubuntu3","1:2.2.9-1ubuntu1","1:2.2.9-1ubuntu2","1:2.2.9-1ubuntu2.1","1:2.2.9-1ubuntu2.3","1:2.2.9-1ubuntu2.4","1:2.2.9-1ubuntu2.5","1:2.2.9-1ubuntu2.6","1:2.2.9-1ubuntu2.6+esm1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-lp150.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-lp151.2.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.16-1.6"}]}],"bundled":22},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dovecot24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.1"}]}],"bundled":24}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"dovecot","product":"dovecot"},{"vendor":"dovecot","product":"pigeonhole"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://www.dovecot.org/security.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/08/28/3","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"https://dovecot.org/pipermail/dovecot-news/2019-August/000417.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00035.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GYTZLLDNIFWT7D7JSB25ERJNMOR4CQ3/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201908-29","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVHY3MU2OK2EWZJFGNDSAOMD42L7DFPX/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSJVVVRAE3SITC2ZLGCPMFDN3WVYZBWF/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2822","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2836","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2885","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00026.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00024.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11500","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GYTZLLDNIFWT7D7JSB25ERJNMOR4CQ3"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVHY3MU2OK2EWZJFGNDSAOMD42L7DFPX"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSJVVVRAE3SITC2ZLGCPMFDN3WVYZBWF"},{"url":"https://github.com/advisories/GHSA-mqm8-r3v6-8mmv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-11500","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-11500","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0261.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25371","tags":["report"]},{"url":"https://dovecot.org/pipermail/dovecot/2019-August/116875.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1741141","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2822.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11500","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11500","tags":["advisory","report"]},{"url":"https://dovecot.org/pipermail/dovecot-news/2019-August/000418.html","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2836.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2885.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192454-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1145559","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11500","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192514-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1133624","tags":["report"]},{"url":"https://bugzilla.suse.com/1133625","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11499","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-11500","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4110-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4110-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4110-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4110-4","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4ZX4AZ5LGOZTCD7HGA6Y7KWE3LMXAGVL/#4ZX4AZ5LGOZTCD7HGA6Y7KWE3LMXAGVL","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IMVHW3467XEMK5NR3ZTGJITWRNY4PIDD/#IMVHW3467XEMK5NR3ZTGJITWRNY4PIDD","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33515","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KZSDCZ5LA6IHY7KXVSL6ULAJVP6OFT2M/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23185","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-11500","description":"In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.","status":"published","published":"2019-08-29T13:51:46Z","modified":"2024-08-04T22:55:40.604Z","updated_at":"2026-11-02T14:20:26.416173Z"}],"euvd":[{"id":"EUVD-2019-3173","description":"In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.","status":"published","published":"2019-08-29T13:51:46Z","modified":"2024-08-04T22:55:40Z","updated_at":"2026-11-03T02:40:48.932719Z"}],"ghsa":[{"id":"GHSA-mqm8-r3v6-8mmv","title":"In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol...","description":"In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.","status":"published","published":"2022-05-24T16:55:10Z","modified":"2024-04-04T01:51:21Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:56:03.407648Z"}],"nvd":[{"id":"CVE-2019-11500","description":"In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.","status":"published","published":"2019-08-29T14:15:11.037Z","modified":"2026-06-17T02:13:01.923Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:05:25.691233Z"}],"osv":[{"id":"ALPINE-CVE-2019-11500","description":"In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.","status":"published","published":"2019-08-29T14:15:11.037Z","modified":"2026-09-21T06:17:52.45974477Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"CVE-2019-11500","description":"In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.","status":"published","published":"2019-08-29T14:15:11.037Z","modified":"2026-10-24T10:30:39.959791919Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"DEBIAN-CVE-2019-11500","description":"In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.","status":"published","published":"2019-08-29T14:15:11.037Z","modified":"2026-09-21T07:01:43.585357208Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"RHSA-2019:2822","title":"Red Hat Security Advisory: dovecot security update","status":"published","published":"2024-09-16T02:53:37Z","modified":"2026-06-26T12:21:56.97223642Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:2836","title":"Red Hat Security Advisory: dovecot security update","status":"published","published":"2024-09-16T02:53:43Z","modified":"2026-06-26T12:21:57.177935773Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:2885","title":"Red Hat Security Advisory: dovecot security update","status":"published","published":"2024-09-16T02:53:48Z","modified":"2026-06-26T12:21:59.821698466Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"UBUNTU-CVE-2019-11500","description":"In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.","status":"published","published":"2019-08-28T12:00:00Z","modified":"2026-04-22T12:06:38.065536Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"DLA-1901-1","title":"dovecot - security update","status":"published","published":"2019-08-29T00:00:00Z","modified":"2026-03-09T01:20:05.447514Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4510-1","title":"dovecot - security update","status":"published","published":"2019-08-28T00:00:00Z","modified":"2026-03-09T02:11:45.827157Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0261","title":"Updated dovecot packages fix security vulnerability","description":"Updated dovecot packages fix security vulnerability:\n\nIMAP protocol parser does not properly handle NUL byte when scanning data\nin quoted strings, leading to out of bounds heap memory writes.\n","status":"published","published":"2019-09-08T14:09:05Z","modified":"2026-04-16T04:41:08.400255639Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:2278-1","title":"Security update for dovecot23","description":"This update for dovecot23 fixes the following issue:\n\n- CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve protocol parsers. (bsc#1145559)\n- CVE-2019-11499: Fixed a vulnerability where the submission-login would crash over a TLS secured channel (bsc#1133625).\n- CVE-2019-11494: Fixed a denial of service if the authentication is aborted by disconnecting (bsc#1133624).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-10-07T14:20:52Z","modified":"2026-02-04T03:58:09.560902Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2281-1","title":"Security update for dovecot23","description":"This update for dovecot23 fixes the following issues:\n\n- CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve protocol parsers. (bsc#1145559)\n- CVE-2019-11499: Fixed a vulnerability where the submission-login would crash over a TLS secured channel (bsc#1133625).\n- CVE-2019-11494: Fixed a denial of service if the authentication is aborted by disconnecting (bsc#1133624).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2019-10-07T14:21:10Z","modified":"2026-02-04T03:42:48.870375Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10726-1","title":"dovecot23-2.3.16-1.6 on GA media","description":"These are all security issues fixed in the dovecot23-2.3.16-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:35.541917Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2025:14715-1","title":"dovecot24-2.4.0-1.1 on GA media","description":"These are all security issues fixed in the dovecot24-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-30T00:00:00Z","modified":"2026-02-04T03:33:59.818366Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2019:2454-1","title":"Security update for dovecot22","description":"This update for dovecot22 fixes the following issues:\n\n- CVE-2019-11500: Fixed a potential remote code execution in the IMAP and ManageSieve protocol parsers (bsc#1145559).\n","status":"published","published":"2019-09-24T14:47:12Z","modified":"2026-02-04T04:18:09.177107Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2514-1","title":"Security update for dovecot23","description":"This update for dovecot23 fixes the following issues:\n\n- CVE-2019-11500: Fixed the NUL byte handling in IMAP and ManageSieve protocol parsers. (bsc#1145559)\n- CVE-2019-11499: Fixed a vulnerability where the submission-login would crash over a TLS secured channel (bsc#1133625).\n- CVE-2019-11494: Fixed a denial of service if the authentication is aborted by disconnecting (bsc#1133624).\n","status":"published","published":"2019-10-02T08:48:43Z","modified":"2026-02-04T03:39:53.220904Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-4110-1","title":"dovecot vulnerability","description":"Nick Roessler and Rafi Rubin discovered that Dovecot incorrectly\nhandled certain data. An attacker could possibly use this issue\nto cause a denial of service or execute arbitrary code.\n","status":"published","published":"2019-08-28T12:30:03Z","modified":"2026-04-22T10:00:06.335493Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4110-2","title":"dovecot vulnerability","description":"USN-4110-1 fixed a vulnerability in Dovecot. This update provides\nthe corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n Nick Roessler and Rafi Rubin discovered that Dovecot incorrectly\n handled certain data. An attacker could possibly use this issue\n to cause a denial of service or execute arbitrary code.\n","status":"published","published":"2019-08-28T14:11:54Z","modified":"2026-04-22T10:00:01.773471Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4110-3","title":"Dovecot regression","description":"USN-4110-1 fixed a vulnerability in Dovecot. The update introduced a\nregression causing a wrong check. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Nick Roessler and Rafi Rubin discovered that Dovecot incorrectly\n handled certain data. An attacker could possibly use this issue\n to cause a denial of service or execute arbitrary code.\n","status":"published","published":"2019-08-28T19:15:57Z","modified":"2026-04-22T10:00:36.054416Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4110-4","title":"dovecot regression","description":"USN-4110-1 fixed a vulnerability in Dovecot. The update introduced\na regression causing a wrong check. This update fixes the problem for\nUbuntu 12.04 ESM and Ubuntu 14.04 ESM.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Nick Roessler and Rafi Rubin discovered that Dovecot incorrectly\n handled certain data. An attacker could possibly use this issue\n to cause a denial of service or execute arbitrary code.\n","status":"published","published":"2019-08-28T23:04:28Z","modified":"2026-04-22T09:59:57.456079Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}