Vulnerability from csaf_suse
Published
2019-02-15 06:04
Modified
2019-02-15 06:04
Summary
Security update for dovecot23
Notes
Title of the patch
Security update for dovecot23
Description of the patch
This update for dovecot23 fixes the following issues:
dovecot was updated to 2.3.3 release, bringing lots of bugfixes (bsc#1124356).
Also the following security issue was fixed:
- CVE-2019-3814: A vulnerability in Dovecot related to SSL client certificate authentication was fixed (bsc#1123022)
The package changes:
Updated pigeonhole to 0.5.3:
- Fix assertion panic occurring when managesieve service fails to
open INBOX while saving a Sieve script. This was caused by a
lack of cleanup after failure.
- Fix specific messages causing an assert panic with actions that
compose a reply (e.g. vacation). With some rather weird input
from the original message, the header folding algorithm (as
used for composing the References header for the reply) got
confused, causing the panic.
- IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
parsing. After finishing reading the Sieve script, the command
parsing sometimes didn't continue with the search arguments.
This is a time- critical bug that likely only occurs when the
Sieve script is sent in the next TCP frame.
dovecot23 was updated to 2.3.3:
- doveconf hides more secrets now in the default output.
- ssl_dh setting is no longer enforced at startup. If it's not
set and non-ECC DH key exchange happens, error is logged and
client is disconnected.
- Added log_debug=<filter> setting.
- Added log_core_filter=<log filter> setting.
- quota-clone: Write to dict asynchronously
- --enable-hardening attempts to use retpoline Spectre 2
mitigations
- lmtp proxy: Support source_ip passdb extra field.
- doveadm stats dump: Support more fields and output stddev
by default.
- push-notification: Add SSL support for OX backend.
- NUL bytes in mail headers can cause truncated replies when fetched.
- director: Conflicting host up/down state changes may in some
rare situations ended up in a loop of two directors constantly
overwriting each others' changes.
- director: Fix hang/crash when multiple doveadm commands are
being handled concurrently.
- director: Fix assert-crash if doveadm disconnects too early
- virtual plugin: Some searches used 100% CPU for many seconds
- dsync assert-crashed with acl plugin in some situations. (bsc#1119850)
- mail_attachment_detection_options=add-flags-on-save
assert-crashed with some specific Sieve scripts.
- Mail snippet generation crashed with mails containing invalid
Content-Type:multipart header.
- Log prefix ordering was different for some log lines.
- quota: With noenforcing option current quota usage wasn't
updated.
- auth: Kerberos authentication against Samba assert-crashed.
- stats clients were unnecessarily chatty with the stats server.
- imapc: Fixed various assert-crashes when reconnecting to
server.
- lmtp, submission: Fix potential crash if client disconnects
while handling a command.
- quota: Fixed compiling with glibc-2.26 / support libtirpc.
- fts-solr: Empty search values resulted in 400 Bad Request
errors
- fts-solr: default_ns parameter couldn't be used
- submission server crashed if relay server returned over 7 lines
in a reply (e.g. to EHLO)
dovecot was updated to 2.3.2.1:
- SSL/TLS servers may have crashed during client disconnection
- lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
sometimes assert-crashed.
- v2.3.2: 'make check' may have crashed with 32bit systems
dovecot was updated to 2.3.2:
- old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
while opening /proc/self/io. This may still cause security
problems if the process is ptrace()d at the same time.
Instead, open it while still running as root.
- doveadm: Added mailbox cache decision&remove commands. See
doveadm-mailbox(1) man page for details.
- doveadm: Added rebuild attachments command for rebuilding
$HasAttachment or $HasNoAttachment flags for matching mails.
See doveadm-rebuild(1) man page for details.
- cassandra: Use fallback_consistency on more types of errors
- lmtp proxy: Support outgoing SSL/TLS connections
- lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
- submission: Add support for rawlog_dir
- submission: Add submission_client_workarounds setting.
- lua auth: Add password_verify() function and additional fields
in auth request.
- doveadm-server: TCP connections are hanging when there is a lot
of network output. This especially caused hangs in
dsync-replication.
- Using multiple type=shared mdbox namespaces crashed
- mail_fsync setting was ignored. It was always set to
'optimized'.
- lua auth: Fix potential crash at deinit
- SSL/TLS servers may have crashed if client disconnected during
handshake.
- SSL/TLS servers: Don't send extraneous certificates to client
when alt certs are used.
- lda, lmtp: Return-Path header without '<' may have
assert-crashed.
- lda, lmtp: Unencoded UTF-8 in email address headers may
assert-crash
- lda: -f parameter didn't allow empty/null/domainless address
- lmtp, submission: Message size limit was hardcoded to 40 MB.
Exceeding it caused the connection to get dropped during
transfer.
- lmtp: Fix potential crash when delivery fails at DATA stage
- lmtp: login_greeting setting was ignored
- Fix to work with OpenSSL v1.0.2f
- systemd unit restrictions were too strict by default
- Fix potential crashes when a lot of log output was produced
- SMTP client may have assert-crashed when sending mail
- IMAP COMPRESS: Send 'end of compression' marker when
disconnecting.
- cassandra: Fix consistency=quorum to work
- dsync: Lock file generation failed if home directory didn't
exist
- Snippet generation for HTML mails didn't ignore &entities
inside blockquotes, producing strange looking snippets.
- imapc: Fix assert-crash if getting disconnected and after
reconnection all mails in the selected mailbox are gone.
- pop3c: Handle unexpected server disconnections without
assert-crash
- fts: Fixes to indexing mails via virtual mailboxes.
- fts: If mails contained NUL characters, the text around it
wasn't indexed.
- Obsolete dovecot.index.cache offsets were sometimes used.
Trying to fetch a field that was just added to cache file may
not have always found it.
pigeonhole was updated to 0.5.2:
- Implement plugin for the a vendor-defined IMAP capability
called 'FILTER=SIEVE'. It adds the ability to manually invoke
Sieve filtering in IMAP. More information can be found in
doc/plugins/imap_filter_sieve.txt.
- The Sieve addess test caused an assertion panic for invalid
addresses with UTF-8 codepoints in the localpart. Fixed by
properly detecting invalid addresses with UTF-8 codepoints in
the localpart and skipping these like other invalid addresses
while iterating addresses for the address test.
- Make the length of the subject header for the vacation response
configurable and enforce the limit in UTF-8 codepoints rather
than bytes. The subject header for a vacation response was
statically truncated to 256 bytes, which is too limited for
multi-byte UTF-8 characters.
- Sieve editheader extension: Fix assertion panic occurring when
it is used to manipulate a message header with a very large
header field.
- Properly abort execution of the sieve_discard script upon
error. Before, the LDA Sieve plugin attempted to execute the
sieve_discard script when an error occurs. This can lead to the
message being lost.
- Fix the interaction between quota and the sieve_discard script.
When quota was used together with a sieve_discard script, the
message delivery did not bounce when the quota was exceeded.
- Fix crash for over quota users
Patchnames
SUSE-2019-414,SUSE-SLE-Module-Server-Applications-15-2019-414
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for dovecot23", title: "Title of the patch", }, { category: "description", text: "\nThis update for dovecot23 fixes the following issues:\n\ndovecot was updated to 2.3.3 release, bringing lots of bugfixes (bsc#1124356).\n\nAlso the following security issue was fixed:\n\n- CVE-2019-3814: A vulnerability in Dovecot related to SSL client certificate authentication was fixed (bsc#1123022)\n\nThe package changes:\n\nUpdated pigeonhole to 0.5.3:\n\n- Fix assertion panic occurring when managesieve service fails to\n open INBOX while saving a Sieve script. This was caused by a\n lack of cleanup after failure.\n- Fix specific messages causing an assert panic with actions that\n compose a reply (e.g. vacation). With some rather weird input\n from the original message, the header folding algorithm (as\n used for composing the References header for the reply) got\n confused, causing the panic.\n- IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command\n parsing. After finishing reading the Sieve script, the command\n parsing sometimes didn't continue with the search arguments.\n This is a time- critical bug that likely only occurs when the\n Sieve script is sent in the next TCP frame.\n\ndovecot23 was updated to 2.3.3:\n\n- doveconf hides more secrets now in the default output.\n- ssl_dh setting is no longer enforced at startup. If it's not\n set and non-ECC DH key exchange happens, error is logged and\n client is disconnected.\n- Added log_debug=<filter> setting.\n- Added log_core_filter=<log filter> setting.\n- quota-clone: Write to dict asynchronously\n- --enable-hardening attempts to use retpoline Spectre 2\n mitigations\n- lmtp proxy: Support source_ip passdb extra field.\n- doveadm stats dump: Support more fields and output stddev\n by default.\n- push-notification: Add SSL support for OX backend.\n- NUL bytes in mail headers can cause truncated replies when fetched.\n- director: Conflicting host up/down state changes may in some\n rare situations ended up in a loop of two directors constantly\n overwriting each others' changes.\n- director: Fix hang/crash when multiple doveadm commands are\n being handled concurrently.\n- director: Fix assert-crash if doveadm disconnects too early\n- virtual plugin: Some searches used 100% CPU for many seconds\n- dsync assert-crashed with acl plugin in some situations. (bsc#1119850)\n- mail_attachment_detection_options=add-flags-on-save\n assert-crashed with some specific Sieve scripts.\n- Mail snippet generation crashed with mails containing invalid\n Content-Type:multipart header.\n- Log prefix ordering was different for some log lines.\n- quota: With noenforcing option current quota usage wasn't\n updated.\n- auth: Kerberos authentication against Samba assert-crashed.\n- stats clients were unnecessarily chatty with the stats server.\n- imapc: Fixed various assert-crashes when reconnecting to\n server.\n- lmtp, submission: Fix potential crash if client disconnects\n while handling a command.\n- quota: Fixed compiling with glibc-2.26 / support libtirpc.\n- fts-solr: Empty search values resulted in 400 Bad Request\n errors\n- fts-solr: default_ns parameter couldn't be used\n- submission server crashed if relay server returned over 7 lines\n in a reply (e.g. to EHLO)\n\ndovecot was updated to 2.3.2.1:\n\n- SSL/TLS servers may have crashed during client disconnection\n- lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have\n sometimes assert-crashed.\n- v2.3.2: 'make check' may have crashed with 32bit systems\n\ndovecot was updated to 2.3.2:\n\n- old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE\n while opening /proc/self/io. This may still cause security\n problems if the process is ptrace()d at the same time.\n Instead, open it while still running as root.\n- doveadm: Added mailbox cache decision&remove commands. See\n doveadm-mailbox(1) man page for details.\n- doveadm: Added rebuild attachments command for rebuilding\n $HasAttachment or $HasNoAttachment flags for matching mails.\n See doveadm-rebuild(1) man page for details.\n- cassandra: Use fallback_consistency on more types of errors\n- lmtp proxy: Support outgoing SSL/TLS connections\n- lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.\n- submission: Add support for rawlog_dir\n- submission: Add submission_client_workarounds setting.\n- lua auth: Add password_verify() function and additional fields\n in auth request.\n- doveadm-server: TCP connections are hanging when there is a lot\n of network output. This especially caused hangs in\n dsync-replication.\n- Using multiple type=shared mdbox namespaces crashed\n- mail_fsync setting was ignored. It was always set to\n 'optimized'.\n- lua auth: Fix potential crash at deinit\n- SSL/TLS servers may have crashed if client disconnected during\n handshake.\n- SSL/TLS servers: Don't send extraneous certificates to client\n when alt certs are used.\n- lda, lmtp: Return-Path header without '<' may have\n assert-crashed.\n- lda, lmtp: Unencoded UTF-8 in email address headers may\n assert-crash\n- lda: -f parameter didn't allow empty/null/domainless address\n- lmtp, submission: Message size limit was hardcoded to 40 MB.\n Exceeding it caused the connection to get dropped during\n transfer.\n- lmtp: Fix potential crash when delivery fails at DATA stage\n- lmtp: login_greeting setting was ignored\n- Fix to work with OpenSSL v1.0.2f\n- systemd unit restrictions were too strict by default\n- Fix potential crashes when a lot of log output was produced\n- SMTP client may have assert-crashed when sending mail\n- IMAP COMPRESS: Send 'end of compression' marker when\n disconnecting.\n- cassandra: Fix consistency=quorum to work\n- dsync: Lock file generation failed if home directory didn't\n exist\n- Snippet generation for HTML mails didn't ignore &entities\n inside blockquotes, producing strange looking snippets.\n- imapc: Fix assert-crash if getting disconnected and after\n reconnection all mails in the selected mailbox are gone.\n- pop3c: Handle unexpected server disconnections without\n assert-crash\n- fts: Fixes to indexing mails via virtual mailboxes.\n- fts: If mails contained NUL characters, the text around it\n wasn't indexed.\n- Obsolete dovecot.index.cache offsets were sometimes used.\n Trying to fetch a field that was just added to cache file may\n not have always found it.\n\npigeonhole was updated to 0.5.2:\n\n- Implement plugin for the a vendor-defined IMAP capability\n called 'FILTER=SIEVE'. It adds the ability to manually invoke\n Sieve filtering in IMAP. More information can be found in\n doc/plugins/imap_filter_sieve.txt.\n- The Sieve addess test caused an assertion panic for invalid\n addresses with UTF-8 codepoints in the localpart. Fixed by\n properly detecting invalid addresses with UTF-8 codepoints in\n the localpart and skipping these like other invalid addresses\n while iterating addresses for the address test.\n- Make the length of the subject header for the vacation response\n configurable and enforce the limit in UTF-8 codepoints rather\n than bytes. The subject header for a vacation response was\n statically truncated to 256 bytes, which is too limited for\n multi-byte UTF-8 characters.\n- Sieve editheader extension: Fix assertion panic occurring when\n it is used to manipulate a message header with a very large\n header field.\n- Properly abort execution of the sieve_discard script upon\n error. Before, the LDA Sieve plugin attempted to execute the\n sieve_discard script when an error occurs. This can lead to the\n message being lost.\n- Fix the interaction between quota and the sieve_discard script.\n When quota was used together with a sieve_discard script, the\n message delivery did not bounce when the quota was exceeded.\n- Fix crash for over quota users\n", title: "Description of the patch", }, { category: "details", text: "SUSE-2019-414,SUSE-SLE-Module-Server-Applications-15-2019-414", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_0414-1.json", }, { category: "self", summary: "URL for SUSE-SU-2019:0414-1", url: "https://www.suse.com/support/update/announcement/2019/suse-su-20190414-1/", }, { category: "self", summary: "E-Mail link for SUSE-SU-2019:0414-1", url: "https://lists.suse.com/pipermail/sle-security-updates/2019-February/005124.html", }, { category: "self", summary: "SUSE Bug 1119850", url: "https://bugzilla.suse.com/1119850", }, { category: "self", summary: "SUSE Bug 1123022", url: "https://bugzilla.suse.com/1123022", }, { category: "self", summary: "SUSE Bug 1124356", url: "https://bugzilla.suse.com/1124356", }, { category: "self", summary: "SUSE CVE CVE-2019-3814 page", url: "https://www.suse.com/security/cve/CVE-2019-3814/", }, ], title: "Security update for dovecot23", tracking: { current_release_date: "2019-02-15T06:04:40Z", generator: { date: "2019-02-15T06:04:40Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "SUSE-SU-2019:0414-1", initial_release_date: "2019-02-15T06:04:40Z", revision_history: [ { date: "2019-02-15T06:04:40Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "dovecot23-2.3.3-4.7.4.aarch64", product: { name: "dovecot23-2.3.3-4.7.4.aarch64", product_id: "dovecot23-2.3.3-4.7.4.aarch64", }, }, { category: "product_version", name: "dovecot23-backend-mysql-2.3.3-4.7.4.aarch64", product: { name: "dovecot23-backend-mysql-2.3.3-4.7.4.aarch64", product_id: "dovecot23-backend-mysql-2.3.3-4.7.4.aarch64", }, }, { category: "product_version", name: "dovecot23-backend-pgsql-2.3.3-4.7.4.aarch64", product: { name: "dovecot23-backend-pgsql-2.3.3-4.7.4.aarch64", product_id: "dovecot23-backend-pgsql-2.3.3-4.7.4.aarch64", }, }, { category: "product_version", name: "dovecot23-backend-sqlite-2.3.3-4.7.4.aarch64", product: { name: "dovecot23-backend-sqlite-2.3.3-4.7.4.aarch64", product_id: "dovecot23-backend-sqlite-2.3.3-4.7.4.aarch64", }, }, { category: "product_version", name: "dovecot23-devel-2.3.3-4.7.4.aarch64", product: { name: "dovecot23-devel-2.3.3-4.7.4.aarch64", product_id: "dovecot23-devel-2.3.3-4.7.4.aarch64", }, }, { category: "product_version", name: "dovecot23-fts-2.3.3-4.7.4.aarch64", product: { name: "dovecot23-fts-2.3.3-4.7.4.aarch64", product_id: "dovecot23-fts-2.3.3-4.7.4.aarch64", }, }, { category: "product_version", name: "dovecot23-fts-lucene-2.3.3-4.7.4.aarch64", product: { name: "dovecot23-fts-lucene-2.3.3-4.7.4.aarch64", product_id: "dovecot23-fts-lucene-2.3.3-4.7.4.aarch64", }, }, { category: "product_version", name: "dovecot23-fts-solr-2.3.3-4.7.4.aarch64", product: { name: "dovecot23-fts-solr-2.3.3-4.7.4.aarch64", product_id: "dovecot23-fts-solr-2.3.3-4.7.4.aarch64", }, }, { category: "product_version", name: "dovecot23-fts-squat-2.3.3-4.7.4.aarch64", product: { name: "dovecot23-fts-squat-2.3.3-4.7.4.aarch64", product_id: "dovecot23-fts-squat-2.3.3-4.7.4.aarch64", }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "dovecot23-2.3.3-4.7.4.i586", product: { name: "dovecot23-2.3.3-4.7.4.i586", product_id: "dovecot23-2.3.3-4.7.4.i586", }, }, { category: "product_version", name: "dovecot23-backend-mysql-2.3.3-4.7.4.i586", product: { name: "dovecot23-backend-mysql-2.3.3-4.7.4.i586", product_id: "dovecot23-backend-mysql-2.3.3-4.7.4.i586", }, }, { category: "product_version", name: "dovecot23-backend-pgsql-2.3.3-4.7.4.i586", product: { name: "dovecot23-backend-pgsql-2.3.3-4.7.4.i586", product_id: "dovecot23-backend-pgsql-2.3.3-4.7.4.i586", }, }, { category: "product_version", name: "dovecot23-backend-sqlite-2.3.3-4.7.4.i586", product: { name: "dovecot23-backend-sqlite-2.3.3-4.7.4.i586", product_id: "dovecot23-backend-sqlite-2.3.3-4.7.4.i586", }, }, { category: "product_version", name: "dovecot23-devel-2.3.3-4.7.4.i586", product: { name: "dovecot23-devel-2.3.3-4.7.4.i586", product_id: "dovecot23-devel-2.3.3-4.7.4.i586", }, }, { category: "product_version", name: "dovecot23-fts-2.3.3-4.7.4.i586", product: { name: "dovecot23-fts-2.3.3-4.7.4.i586", product_id: "dovecot23-fts-2.3.3-4.7.4.i586", }, }, { category: "product_version", name: "dovecot23-fts-lucene-2.3.3-4.7.4.i586", product: { name: "dovecot23-fts-lucene-2.3.3-4.7.4.i586", product_id: "dovecot23-fts-lucene-2.3.3-4.7.4.i586", }, }, { category: "product_version", name: "dovecot23-fts-solr-2.3.3-4.7.4.i586", product: { name: "dovecot23-fts-solr-2.3.3-4.7.4.i586", product_id: "dovecot23-fts-solr-2.3.3-4.7.4.i586", }, }, { category: "product_version", name: "dovecot23-fts-squat-2.3.3-4.7.4.i586", product: { name: "dovecot23-fts-squat-2.3.3-4.7.4.i586", product_id: "dovecot23-fts-squat-2.3.3-4.7.4.i586", }, }, ], category: "architecture", name: "i586", }, { branches: [ { category: "product_version", name: "dovecot23-2.3.3-4.7.4.ppc64le", product: { name: "dovecot23-2.3.3-4.7.4.ppc64le", product_id: "dovecot23-2.3.3-4.7.4.ppc64le", }, }, { category: "product_version", name: "dovecot23-backend-mysql-2.3.3-4.7.4.ppc64le", product: { name: "dovecot23-backend-mysql-2.3.3-4.7.4.ppc64le", product_id: "dovecot23-backend-mysql-2.3.3-4.7.4.ppc64le", }, }, { category: "product_version", name: "dovecot23-backend-pgsql-2.3.3-4.7.4.ppc64le", product: { name: "dovecot23-backend-pgsql-2.3.3-4.7.4.ppc64le", product_id: "dovecot23-backend-pgsql-2.3.3-4.7.4.ppc64le", }, }, { category: "product_version", name: "dovecot23-backend-sqlite-2.3.3-4.7.4.ppc64le", product: { name: "dovecot23-backend-sqlite-2.3.3-4.7.4.ppc64le", product_id: "dovecot23-backend-sqlite-2.3.3-4.7.4.ppc64le", }, }, { category: "product_version", name: "dovecot23-devel-2.3.3-4.7.4.ppc64le", product: { name: "dovecot23-devel-2.3.3-4.7.4.ppc64le", product_id: "dovecot23-devel-2.3.3-4.7.4.ppc64le", }, }, { category: "product_version", name: "dovecot23-fts-2.3.3-4.7.4.ppc64le", product: { name: "dovecot23-fts-2.3.3-4.7.4.ppc64le", product_id: "dovecot23-fts-2.3.3-4.7.4.ppc64le", }, }, { category: "product_version", name: "dovecot23-fts-lucene-2.3.3-4.7.4.ppc64le", product: { name: "dovecot23-fts-lucene-2.3.3-4.7.4.ppc64le", product_id: "dovecot23-fts-lucene-2.3.3-4.7.4.ppc64le", }, }, { category: "product_version", name: "dovecot23-fts-solr-2.3.3-4.7.4.ppc64le", product: { name: "dovecot23-fts-solr-2.3.3-4.7.4.ppc64le", product_id: "dovecot23-fts-solr-2.3.3-4.7.4.ppc64le", }, }, { category: "product_version", name: "dovecot23-fts-squat-2.3.3-4.7.4.ppc64le", product: { name: "dovecot23-fts-squat-2.3.3-4.7.4.ppc64le", product_id: "dovecot23-fts-squat-2.3.3-4.7.4.ppc64le", }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "dovecot23-2.3.3-4.7.4.s390x", product: { name: "dovecot23-2.3.3-4.7.4.s390x", product_id: "dovecot23-2.3.3-4.7.4.s390x", }, }, { category: "product_version", name: "dovecot23-backend-mysql-2.3.3-4.7.4.s390x", product: { name: "dovecot23-backend-mysql-2.3.3-4.7.4.s390x", product_id: "dovecot23-backend-mysql-2.3.3-4.7.4.s390x", }, }, { category: "product_version", name: "dovecot23-backend-pgsql-2.3.3-4.7.4.s390x", product: { name: "dovecot23-backend-pgsql-2.3.3-4.7.4.s390x", product_id: "dovecot23-backend-pgsql-2.3.3-4.7.4.s390x", }, }, { category: "product_version", name: "dovecot23-backend-sqlite-2.3.3-4.7.4.s390x", product: { name: "dovecot23-backend-sqlite-2.3.3-4.7.4.s390x", product_id: "dovecot23-backend-sqlite-2.3.3-4.7.4.s390x", }, }, { category: "product_version", name: "dovecot23-devel-2.3.3-4.7.4.s390x", product: { name: "dovecot23-devel-2.3.3-4.7.4.s390x", product_id: "dovecot23-devel-2.3.3-4.7.4.s390x", }, }, { category: "product_version", name: "dovecot23-fts-2.3.3-4.7.4.s390x", product: { name: "dovecot23-fts-2.3.3-4.7.4.s390x", product_id: "dovecot23-fts-2.3.3-4.7.4.s390x", }, }, { category: "product_version", name: "dovecot23-fts-lucene-2.3.3-4.7.4.s390x", product: { name: "dovecot23-fts-lucene-2.3.3-4.7.4.s390x", product_id: "dovecot23-fts-lucene-2.3.3-4.7.4.s390x", }, }, { category: "product_version", name: "dovecot23-fts-solr-2.3.3-4.7.4.s390x", product: { name: "dovecot23-fts-solr-2.3.3-4.7.4.s390x", product_id: "dovecot23-fts-solr-2.3.3-4.7.4.s390x", }, }, { category: "product_version", name: "dovecot23-fts-squat-2.3.3-4.7.4.s390x", product: { name: "dovecot23-fts-squat-2.3.3-4.7.4.s390x", product_id: "dovecot23-fts-squat-2.3.3-4.7.4.s390x", }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "dovecot23-2.3.3-4.7.4.x86_64", product: { name: "dovecot23-2.3.3-4.7.4.x86_64", product_id: "dovecot23-2.3.3-4.7.4.x86_64", }, }, { category: "product_version", name: "dovecot23-backend-mysql-2.3.3-4.7.4.x86_64", product: { name: "dovecot23-backend-mysql-2.3.3-4.7.4.x86_64", product_id: "dovecot23-backend-mysql-2.3.3-4.7.4.x86_64", }, }, { category: "product_version", name: "dovecot23-backend-pgsql-2.3.3-4.7.4.x86_64", product: { name: "dovecot23-backend-pgsql-2.3.3-4.7.4.x86_64", product_id: "dovecot23-backend-pgsql-2.3.3-4.7.4.x86_64", }, }, { category: "product_version", name: "dovecot23-backend-sqlite-2.3.3-4.7.4.x86_64", product: { name: "dovecot23-backend-sqlite-2.3.3-4.7.4.x86_64", product_id: "dovecot23-backend-sqlite-2.3.3-4.7.4.x86_64", }, }, { category: "product_version", name: "dovecot23-devel-2.3.3-4.7.4.x86_64", product: { name: "dovecot23-devel-2.3.3-4.7.4.x86_64", product_id: "dovecot23-devel-2.3.3-4.7.4.x86_64", }, }, { category: "product_version", name: "dovecot23-fts-2.3.3-4.7.4.x86_64", product: { name: "dovecot23-fts-2.3.3-4.7.4.x86_64", product_id: "dovecot23-fts-2.3.3-4.7.4.x86_64", }, }, { category: "product_version", name: "dovecot23-fts-lucene-2.3.3-4.7.4.x86_64", product: { name: "dovecot23-fts-lucene-2.3.3-4.7.4.x86_64", product_id: "dovecot23-fts-lucene-2.3.3-4.7.4.x86_64", }, }, { category: "product_version", name: "dovecot23-fts-solr-2.3.3-4.7.4.x86_64", product: { name: "dovecot23-fts-solr-2.3.3-4.7.4.x86_64", product_id: "dovecot23-fts-solr-2.3.3-4.7.4.x86_64", }, }, { category: "product_version", name: "dovecot23-fts-squat-2.3.3-4.7.4.x86_64", product: { name: "dovecot23-fts-squat-2.3.3-4.7.4.x86_64", product_id: "dovecot23-fts-squat-2.3.3-4.7.4.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "SUSE Linux Enterprise Module for Server Applications 15", product: { name: "SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15", product_identification_helper: { cpe: "cpe:/o:suse:sle-module-server-applications:15", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "dovecot23-2.3.3-4.7.4.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-2.3.3-4.7.4.aarch64", }, product_reference: "dovecot23-2.3.3-4.7.4.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-2.3.3-4.7.4.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-2.3.3-4.7.4.ppc64le", }, product_reference: "dovecot23-2.3.3-4.7.4.ppc64le", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-2.3.3-4.7.4.s390x as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-2.3.3-4.7.4.s390x", }, product_reference: "dovecot23-2.3.3-4.7.4.s390x", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-2.3.3-4.7.4.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-2.3.3-4.7.4.x86_64", }, product_reference: "dovecot23-2.3.3-4.7.4.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-backend-mysql-2.3.3-4.7.4.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-mysql-2.3.3-4.7.4.aarch64", }, product_reference: "dovecot23-backend-mysql-2.3.3-4.7.4.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-backend-mysql-2.3.3-4.7.4.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-mysql-2.3.3-4.7.4.ppc64le", }, product_reference: "dovecot23-backend-mysql-2.3.3-4.7.4.ppc64le", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-backend-mysql-2.3.3-4.7.4.s390x as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-mysql-2.3.3-4.7.4.s390x", }, product_reference: "dovecot23-backend-mysql-2.3.3-4.7.4.s390x", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-backend-mysql-2.3.3-4.7.4.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-mysql-2.3.3-4.7.4.x86_64", }, product_reference: "dovecot23-backend-mysql-2.3.3-4.7.4.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-backend-pgsql-2.3.3-4.7.4.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-pgsql-2.3.3-4.7.4.aarch64", }, product_reference: "dovecot23-backend-pgsql-2.3.3-4.7.4.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-backend-pgsql-2.3.3-4.7.4.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-pgsql-2.3.3-4.7.4.ppc64le", }, product_reference: "dovecot23-backend-pgsql-2.3.3-4.7.4.ppc64le", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-backend-pgsql-2.3.3-4.7.4.s390x as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-pgsql-2.3.3-4.7.4.s390x", }, product_reference: "dovecot23-backend-pgsql-2.3.3-4.7.4.s390x", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-backend-pgsql-2.3.3-4.7.4.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-pgsql-2.3.3-4.7.4.x86_64", }, product_reference: "dovecot23-backend-pgsql-2.3.3-4.7.4.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-backend-sqlite-2.3.3-4.7.4.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-sqlite-2.3.3-4.7.4.aarch64", }, product_reference: "dovecot23-backend-sqlite-2.3.3-4.7.4.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-backend-sqlite-2.3.3-4.7.4.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-sqlite-2.3.3-4.7.4.ppc64le", }, product_reference: "dovecot23-backend-sqlite-2.3.3-4.7.4.ppc64le", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-backend-sqlite-2.3.3-4.7.4.s390x as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-sqlite-2.3.3-4.7.4.s390x", }, product_reference: "dovecot23-backend-sqlite-2.3.3-4.7.4.s390x", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-backend-sqlite-2.3.3-4.7.4.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-sqlite-2.3.3-4.7.4.x86_64", }, product_reference: "dovecot23-backend-sqlite-2.3.3-4.7.4.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-devel-2.3.3-4.7.4.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-devel-2.3.3-4.7.4.aarch64", }, product_reference: "dovecot23-devel-2.3.3-4.7.4.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-devel-2.3.3-4.7.4.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-devel-2.3.3-4.7.4.ppc64le", }, product_reference: "dovecot23-devel-2.3.3-4.7.4.ppc64le", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-devel-2.3.3-4.7.4.s390x as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-devel-2.3.3-4.7.4.s390x", }, product_reference: "dovecot23-devel-2.3.3-4.7.4.s390x", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-devel-2.3.3-4.7.4.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-devel-2.3.3-4.7.4.x86_64", }, product_reference: "dovecot23-devel-2.3.3-4.7.4.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-fts-2.3.3-4.7.4.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-2.3.3-4.7.4.aarch64", }, product_reference: "dovecot23-fts-2.3.3-4.7.4.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-fts-2.3.3-4.7.4.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-2.3.3-4.7.4.ppc64le", }, product_reference: "dovecot23-fts-2.3.3-4.7.4.ppc64le", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-fts-2.3.3-4.7.4.s390x as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-2.3.3-4.7.4.s390x", }, product_reference: "dovecot23-fts-2.3.3-4.7.4.s390x", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-fts-2.3.3-4.7.4.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-2.3.3-4.7.4.x86_64", }, product_reference: "dovecot23-fts-2.3.3-4.7.4.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-fts-lucene-2.3.3-4.7.4.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-lucene-2.3.3-4.7.4.aarch64", }, product_reference: "dovecot23-fts-lucene-2.3.3-4.7.4.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-fts-lucene-2.3.3-4.7.4.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-lucene-2.3.3-4.7.4.ppc64le", }, product_reference: "dovecot23-fts-lucene-2.3.3-4.7.4.ppc64le", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-fts-lucene-2.3.3-4.7.4.s390x as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-lucene-2.3.3-4.7.4.s390x", }, product_reference: "dovecot23-fts-lucene-2.3.3-4.7.4.s390x", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-fts-lucene-2.3.3-4.7.4.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-lucene-2.3.3-4.7.4.x86_64", }, product_reference: "dovecot23-fts-lucene-2.3.3-4.7.4.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-fts-solr-2.3.3-4.7.4.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-solr-2.3.3-4.7.4.aarch64", }, product_reference: "dovecot23-fts-solr-2.3.3-4.7.4.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-fts-solr-2.3.3-4.7.4.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-solr-2.3.3-4.7.4.ppc64le", }, product_reference: "dovecot23-fts-solr-2.3.3-4.7.4.ppc64le", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-fts-solr-2.3.3-4.7.4.s390x as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-solr-2.3.3-4.7.4.s390x", }, product_reference: "dovecot23-fts-solr-2.3.3-4.7.4.s390x", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-fts-solr-2.3.3-4.7.4.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-solr-2.3.3-4.7.4.x86_64", }, product_reference: "dovecot23-fts-solr-2.3.3-4.7.4.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-fts-squat-2.3.3-4.7.4.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-squat-2.3.3-4.7.4.aarch64", }, product_reference: "dovecot23-fts-squat-2.3.3-4.7.4.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-fts-squat-2.3.3-4.7.4.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-squat-2.3.3-4.7.4.ppc64le", }, product_reference: "dovecot23-fts-squat-2.3.3-4.7.4.ppc64le", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-fts-squat-2.3.3-4.7.4.s390x as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-squat-2.3.3-4.7.4.s390x", }, product_reference: "dovecot23-fts-squat-2.3.3-4.7.4.s390x", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, { category: "default_component_of", full_product_name: { name: "dovecot23-fts-squat-2.3.3-4.7.4.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15", product_id: "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-squat-2.3.3-4.7.4.x86_64", }, product_reference: "dovecot23-fts-squat-2.3.3-4.7.4.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15", }, ], }, vulnerabilities: [ { cve: "CVE-2019-3814", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-3814", }, ], notes: [ { category: "general", text: "It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-mysql-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-mysql-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-mysql-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-mysql-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-pgsql-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-pgsql-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-pgsql-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-pgsql-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-sqlite-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-sqlite-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-sqlite-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-sqlite-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-devel-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-devel-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-devel-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-devel-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-lucene-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-lucene-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-lucene-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-lucene-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-solr-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-solr-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-solr-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-solr-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-squat-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-squat-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-squat-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-squat-2.3.3-4.7.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-3814", url: "https://www.suse.com/security/cve/CVE-2019-3814", }, { category: "external", summary: "SUSE Bug 1123022 for CVE-2019-3814", url: "https://bugzilla.suse.com/1123022", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-mysql-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-mysql-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-mysql-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-mysql-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-pgsql-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-pgsql-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-pgsql-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-pgsql-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-sqlite-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-sqlite-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-sqlite-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-sqlite-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-devel-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-devel-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-devel-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-devel-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-lucene-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-lucene-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-lucene-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-lucene-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-solr-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-solr-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-solr-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-solr-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-squat-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-squat-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-squat-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-squat-2.3.3-4.7.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.2, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", version: "3.0", }, products: [ "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-mysql-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-mysql-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-mysql-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-mysql-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-pgsql-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-pgsql-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-pgsql-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-pgsql-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-sqlite-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-sqlite-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-sqlite-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-backend-sqlite-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-devel-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-devel-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-devel-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-devel-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-lucene-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-lucene-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-lucene-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-lucene-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-solr-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-solr-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-solr-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-solr-2.3.3-4.7.4.x86_64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-squat-2.3.3-4.7.4.aarch64", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-squat-2.3.3-4.7.4.ppc64le", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-squat-2.3.3-4.7.4.s390x", "SUSE Linux Enterprise Module for Server Applications 15:dovecot23-fts-squat-2.3.3-4.7.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2019-02-15T06:04:40Z", details: "important", }, ], title: "CVE-2019-3814", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.