Synopsis

Important: dovecot security update

Type/Severity

Security Advisory: Important

Topic

An update for dovecot is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

• dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes (CVE-2019-11500)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.0 ppc64le
• Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.0 x86_64
• Red Hat CodeReady Linux Builder for x86_64 8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x

Fixes

• BZ - 1741141 - CVE-2019-11500 dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes

CVEs

• CVE-2019-11500

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux for x86_64 8

SRPM
dovecot-2.2.36-5.el8_0.1.src.rpm	SHA-256: 83da125cf8f2ede5b1a3cba1839ff713f4dfc3665d9eff1cc7eaa6b9bceef78e
x86_64
dovecot-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: f69a8bd40f93d879592ddf02bd5292522c0f0504e1a0730f05a735fbec9183ad
dovecot-debuginfo-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: 27b72dba31f292ce8ee7cf0a7c0f8142c1a031fb84aabf9fcabc26efedefd789
dovecot-debugsource-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: a46e7bc28dc4ca9535cc7c6dfe57f8e8d7ade4140a36d61e79a53858cb8b8290
dovecot-mysql-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: e1dea0cef9a8c10b22d4cd4ac07eb5ab75052c866abe817a67b80fe7d2ec37a2
dovecot-mysql-debuginfo-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: 32032fcdd24bb54c443548da4a17b7ecc5a95209a273fa46a190d3ca6a53087f
dovecot-pgsql-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: 63be29bff7729fcb5b0f19ef0deeef3ce05ebbc07e57443511652df38fdb5c77
dovecot-pgsql-debuginfo-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: 1c9dee6afd568773f90402e629caa397ff7e096dc6b4098cbcd3e3a462a74b63
dovecot-pigeonhole-debuginfo-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: aab5a3f7d6511fc9abb5945563025a0f7a495c6980cbecbc1dcbcce3d6c4843e

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
dovecot-2.2.36-5.el8_0.1.src.rpm	SHA-256: 83da125cf8f2ede5b1a3cba1839ff713f4dfc3665d9eff1cc7eaa6b9bceef78e
s390x
dovecot-2.2.36-5.el8_0.1.s390x.rpm	SHA-256: 6ae3ac5c720137111f58c0dc66270187f3239e53d6f1396a35246a0196259b86
dovecot-debuginfo-2.2.36-5.el8_0.1.s390x.rpm	SHA-256: 959c79f82985afa1d7d8bd34e35bb1082d824da3b36cc424abae73bdf68d1f02
dovecot-debugsource-2.2.36-5.el8_0.1.s390x.rpm	SHA-256: f74d7b64a1a0cedf28f8075084e6fb64a4d65ee577fb449ab359ec143a22e206
dovecot-mysql-2.2.36-5.el8_0.1.s390x.rpm	SHA-256: d3a9e10cae9b5635502579b3ab2d8a4ac0b5f4f5505b1ffc69b2bf06699e8e37
dovecot-mysql-debuginfo-2.2.36-5.el8_0.1.s390x.rpm	SHA-256: dd606abeb8866c0b4d76e56882e4cd73de0222097d9073a460a3040b7614179c
dovecot-pgsql-2.2.36-5.el8_0.1.s390x.rpm	SHA-256: 56e16d8cd587a2fc19ae4498dca50ccf268866667e97fed9ba753f11b76f5969
dovecot-pgsql-debuginfo-2.2.36-5.el8_0.1.s390x.rpm	SHA-256: 5dcaa1538b03534cd5281d6cc5f2467ea5ee12514bfeee8c0b8fc0e6ee838b88
dovecot-pigeonhole-debuginfo-2.2.36-5.el8_0.1.s390x.rpm	SHA-256: 60436c8204dc0d5ca340393b09089e426c54f07d17e0fc48518b06e32b9b1163

Red Hat Enterprise Linux for Power, little endian 8

SRPM
dovecot-2.2.36-5.el8_0.1.src.rpm	SHA-256: 83da125cf8f2ede5b1a3cba1839ff713f4dfc3665d9eff1cc7eaa6b9bceef78e
ppc64le
dovecot-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: b24acce6960982f8eecdd11051dbec7bde11159899faff050dd05039c16c596c
dovecot-debuginfo-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: 23a17318c37e6c34567624de6c52eff082c4a654fd69d2e674a14e47cf84984f
dovecot-debugsource-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: 1d0eb55c783332ea6dbdf571805705843a53d386fdaeb957866b4ec5aca68e62
dovecot-mysql-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: 7ffe34912300db64695d40d6674f0820d739cc09b12d5311ec92f44ebcc19cf0
dovecot-mysql-debuginfo-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: 16dcad6638ad450e60a04f2a83bfcf20f7161c3efa26603eae180488cdabb2e9
dovecot-pgsql-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: ffa6c4322ec38a91cb10f6d128753184020b4957a1085d977ab6eecaa204db5e
dovecot-pgsql-debuginfo-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: d7917a5f9690459da6adad0e76dc71a7b38a3e5278025f007602504b95d98d65
dovecot-pigeonhole-debuginfo-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: 14ad293935d8e413490d1cab98b987ba5fea7ed5c419fd32354b99cc3db8e04c

Red Hat Enterprise Linux for ARM 64 8

SRPM
dovecot-2.2.36-5.el8_0.1.src.rpm	SHA-256: 83da125cf8f2ede5b1a3cba1839ff713f4dfc3665d9eff1cc7eaa6b9bceef78e
aarch64
dovecot-2.2.36-5.el8_0.1.aarch64.rpm	SHA-256: b893b6ed8cc630f463ed298cf391f9b964ecc8fd78f29d1859122be55af5656c
dovecot-debuginfo-2.2.36-5.el8_0.1.aarch64.rpm	SHA-256: 713845922413e4abf55839639731ffd8565bd6d1e87f6916e08256c4b8b43fe0
dovecot-debugsource-2.2.36-5.el8_0.1.aarch64.rpm	SHA-256: 2b6e48e6b58a82a06c5ac3856568f0f12554a7ee86bf6644b757324b50bf8a2e
dovecot-mysql-2.2.36-5.el8_0.1.aarch64.rpm	SHA-256: bc1709bb3420ce176dff07db053247d462bb8d1030b221b7e3ecb600483f008a
dovecot-mysql-debuginfo-2.2.36-5.el8_0.1.aarch64.rpm	SHA-256: 357854746ef8ddcbee6a8b95f11c7bc31ac82e34ddb043066192980f8d5c1c50
dovecot-pgsql-2.2.36-5.el8_0.1.aarch64.rpm	SHA-256: 5a607f3b96b286a0afd5474449dc4e169f60aa35bed65a4d3b856040d46b76ab
dovecot-pgsql-debuginfo-2.2.36-5.el8_0.1.aarch64.rpm	SHA-256: 5af37c63d2a5d510c1e78c0f884bf4f7741479eaa88b007fe5e43a5866edba82
dovecot-pigeonhole-debuginfo-2.2.36-5.el8_0.1.aarch64.rpm	SHA-256: 47a981ce5b368a157a1328116090ba9e332d66f5c5809cc448bc0d03335a39b6

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.0

SRPM
dovecot-2.2.36-5.el8_0.1.src.rpm	SHA-256: 83da125cf8f2ede5b1a3cba1839ff713f4dfc3665d9eff1cc7eaa6b9bceef78e
ppc64le
dovecot-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: b24acce6960982f8eecdd11051dbec7bde11159899faff050dd05039c16c596c
dovecot-debuginfo-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: 23a17318c37e6c34567624de6c52eff082c4a654fd69d2e674a14e47cf84984f
dovecot-debugsource-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: 1d0eb55c783332ea6dbdf571805705843a53d386fdaeb957866b4ec5aca68e62
dovecot-mysql-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: 7ffe34912300db64695d40d6674f0820d739cc09b12d5311ec92f44ebcc19cf0
dovecot-mysql-debuginfo-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: 16dcad6638ad450e60a04f2a83bfcf20f7161c3efa26603eae180488cdabb2e9
dovecot-pgsql-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: ffa6c4322ec38a91cb10f6d128753184020b4957a1085d977ab6eecaa204db5e
dovecot-pgsql-debuginfo-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: d7917a5f9690459da6adad0e76dc71a7b38a3e5278025f007602504b95d98d65
dovecot-pigeonhole-debuginfo-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: 14ad293935d8e413490d1cab98b987ba5fea7ed5c419fd32354b99cc3db8e04c

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.0

SRPM
dovecot-2.2.36-5.el8_0.1.src.rpm	SHA-256: 83da125cf8f2ede5b1a3cba1839ff713f4dfc3665d9eff1cc7eaa6b9bceef78e
x86_64
dovecot-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: f69a8bd40f93d879592ddf02bd5292522c0f0504e1a0730f05a735fbec9183ad
dovecot-debuginfo-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: 27b72dba31f292ce8ee7cf0a7c0f8142c1a031fb84aabf9fcabc26efedefd789
dovecot-debugsource-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: a46e7bc28dc4ca9535cc7c6dfe57f8e8d7ade4140a36d61e79a53858cb8b8290
dovecot-mysql-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: e1dea0cef9a8c10b22d4cd4ac07eb5ab75052c866abe817a67b80fe7d2ec37a2
dovecot-mysql-debuginfo-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: 32032fcdd24bb54c443548da4a17b7ecc5a95209a273fa46a190d3ca6a53087f
dovecot-pgsql-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: 63be29bff7729fcb5b0f19ef0deeef3ce05ebbc07e57443511652df38fdb5c77
dovecot-pgsql-debuginfo-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: 1c9dee6afd568773f90402e629caa397ff7e096dc6b4098cbcd3e3a462a74b63
dovecot-pigeonhole-debuginfo-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: aab5a3f7d6511fc9abb5945563025a0f7a495c6980cbecbc1dcbcce3d6c4843e

Red Hat CodeReady Linux Builder for x86_64 8

SRPM
x86_64
dovecot-2.2.36-5.el8_0.1.i686.rpm	SHA-256: 1368aadc2ba77962963cc2a623033cc2a65d2c2bbdc3c322daf57f494048f84c
dovecot-debuginfo-2.2.36-5.el8_0.1.i686.rpm	SHA-256: 18433f3cc1c7ec005abd881c2c4f861c22bd42fbb7dba91bba220bb36c7be46c
dovecot-debuginfo-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: 27b72dba31f292ce8ee7cf0a7c0f8142c1a031fb84aabf9fcabc26efedefd789
dovecot-debugsource-2.2.36-5.el8_0.1.i686.rpm	SHA-256: 23c292febe9d99e7780e03d4460d26a880653ab9f53b7ba546d67253fb850d02
dovecot-debugsource-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: a46e7bc28dc4ca9535cc7c6dfe57f8e8d7ade4140a36d61e79a53858cb8b8290
dovecot-devel-2.2.36-5.el8_0.1.i686.rpm	SHA-256: 1a242389638a45117b264723af3ca879bbd7239fd3ab568d243635ff50cb98c6
dovecot-devel-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: 432a16ddd0b3af7fb33416fecf37d1ea8cfea487a2dc9fc9439588c721a25f49
dovecot-mysql-debuginfo-2.2.36-5.el8_0.1.i686.rpm	SHA-256: 19692c515fbc1dc3cf82f8e95428c8582f4a4fe547691c4d2af0451ae7fcb63c
dovecot-mysql-debuginfo-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: 32032fcdd24bb54c443548da4a17b7ecc5a95209a273fa46a190d3ca6a53087f
dovecot-pgsql-debuginfo-2.2.36-5.el8_0.1.i686.rpm	SHA-256: e689f1abbd6fdc490a04d7fc69d4435637b40b9ee76163201ad7253da26418a6
dovecot-pgsql-debuginfo-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: 1c9dee6afd568773f90402e629caa397ff7e096dc6b4098cbcd3e3a462a74b63
dovecot-pigeonhole-debuginfo-2.2.36-5.el8_0.1.i686.rpm	SHA-256: 4502c33dc01bc9d1d1f1a1869d0288ae12b7068b98622e1f32c5dae856d9be80
dovecot-pigeonhole-debuginfo-2.2.36-5.el8_0.1.x86_64.rpm	SHA-256: aab5a3f7d6511fc9abb5945563025a0f7a495c6980cbecbc1dcbcce3d6c4843e

Red Hat CodeReady Linux Builder for Power, little endian 8

SRPM
ppc64le
dovecot-debuginfo-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: 23a17318c37e6c34567624de6c52eff082c4a654fd69d2e674a14e47cf84984f
dovecot-debugsource-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: 1d0eb55c783332ea6dbdf571805705843a53d386fdaeb957866b4ec5aca68e62
dovecot-devel-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: fb6e0fec4fe63db3b0ee5256fac80510f360822c8a0c9fd327d23f6b4e41065d
dovecot-mysql-debuginfo-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: 16dcad6638ad450e60a04f2a83bfcf20f7161c3efa26603eae180488cdabb2e9
dovecot-pgsql-debuginfo-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: d7917a5f9690459da6adad0e76dc71a7b38a3e5278025f007602504b95d98d65
dovecot-pigeonhole-debuginfo-2.2.36-5.el8_0.1.ppc64le.rpm	SHA-256: 14ad293935d8e413490d1cab98b987ba5fea7ed5c419fd32354b99cc3db8e04c

Red Hat CodeReady Linux Builder for ARM 64 8

SRPM
aarch64
dovecot-debuginfo-2.2.36-5.el8_0.1.aarch64.rpm	SHA-256: 713845922413e4abf55839639731ffd8565bd6d1e87f6916e08256c4b8b43fe0
dovecot-debugsource-2.2.36-5.el8_0.1.aarch64.rpm	SHA-256: 2b6e48e6b58a82a06c5ac3856568f0f12554a7ee86bf6644b757324b50bf8a2e
dovecot-devel-2.2.36-5.el8_0.1.aarch64.rpm	SHA-256: 7838673bea615c8228e68186722ee10f6fc479b6b2931efe189e7786be3863bd
dovecot-mysql-debuginfo-2.2.36-5.el8_0.1.aarch64.rpm	SHA-256: 357854746ef8ddcbee6a8b95f11c7bc31ac82e34ddb043066192980f8d5c1c50
dovecot-pgsql-debuginfo-2.2.36-5.el8_0.1.aarch64.rpm	SHA-256: 5af37c63d2a5d510c1e78c0f884bf4f7741479eaa88b007fe5e43a5866edba82
dovecot-pigeonhole-debuginfo-2.2.36-5.el8_0.1.aarch64.rpm	SHA-256: 47a981ce5b368a157a1328116090ba9e332d66f5c5809cc448bc0d03335a39b6

Red Hat CodeReady Linux Builder for IBM z Systems 8

SRPM
s390x
dovecot-debuginfo-2.2.36-5.el8_0.1.s390x.rpm	SHA-256: 959c79f82985afa1d7d8bd34e35bb1082d824da3b36cc424abae73bdf68d1f02
dovecot-debugsource-2.2.36-5.el8_0.1.s390x.rpm	SHA-256: f74d7b64a1a0cedf28f8075084e6fb64a4d65ee577fb449ab359ec143a22e206
dovecot-devel-2.2.36-5.el8_0.1.s390x.rpm	SHA-256: 12c514dc24ab3aae6508982e68c316ce3a0b13ee50262f8e7ad4dd5ccb461a73
dovecot-mysql-debuginfo-2.2.36-5.el8_0.1.s390x.rpm	SHA-256: dd606abeb8866c0b4d76e56882e4cd73de0222097d9073a460a3040b7614179c
dovecot-pgsql-debuginfo-2.2.36-5.el8_0.1.s390x.rpm	SHA-256: 5dcaa1538b03534cd5281d6cc5f2467ea5ee12514bfeee8c0b8fc0e6ee838b88
dovecot-pigeonhole-debuginfo-2.2.36-5.el8_0.1.s390x.rpm	SHA-256: 60436c8204dc0d5ca340393b09089e426c54f07d17e0fc48518b06e32b9b1163