Issued:
2020-03-31
Updated:
2020-03-31

RHSA-2020:1062 - Security Advisory

Synopsis

Moderate: dovecot security and bug fix update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for dovecot is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

  • dovecot: Improper certificate validation (CVE-2019-3814)
  • dovecot: Buffer overflow in indexer-worker process results in privilege escalation (CVE-2019-7524)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server 7 x86_64
  • Red Hat Enterprise Linux Workstation 7 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 7 s390x
  • Red Hat Enterprise Linux for Power, big endian 7 ppc64
  • Red Hat Enterprise Linux for Power, little endian 7 ppc64le

Fixes

  • BZ - 1570283 - Dovecot should use portrelease to avoid port conflicts with NFSv4 mounts
  • BZ - 1673415 - CVE-2019-3814 dovecot: Improper certificate validation
  • BZ - 1696152 - CVE-2019-7524 dovecot: Buffer overflow in indexer-worker process results in privilege escalation

Red Hat Enterprise Linux Server 7

SRPM
dovecot-2.2.36-6.el7.src.rpm SHA-256: c68ea97de7315ceb8e907bc5274638c67dfdfbb5ee872c7bdf9ec6acb79a7305
x86_64
dovecot-2.2.36-6.el7.i686.rpm SHA-256: 01525c5b409a4cfed6e49b9cdd63bfb658332749dc6a23c53ac71836a5b00201
dovecot-2.2.36-6.el7.x86_64.rpm SHA-256: 9f9521445ec2d4ee68a3ea930f14344aae23a990aeeb755d623329d2ccc29bcd
dovecot-debuginfo-2.2.36-6.el7.i686.rpm SHA-256: 43e14ea66b0211b82f1580980f04153cb85d2fdde70a2e6273416eac286c72ff
dovecot-debuginfo-2.2.36-6.el7.x86_64.rpm SHA-256: 1c7da0da5a94f3da2f273c19f68f07048241faf39f10f2f60b3cfef29176a9d7
dovecot-debuginfo-2.2.36-6.el7.x86_64.rpm SHA-256: 1c7da0da5a94f3da2f273c19f68f07048241faf39f10f2f60b3cfef29176a9d7
dovecot-devel-2.2.36-6.el7.x86_64.rpm SHA-256: 2615c888c3c42b5a65b8fbfce4e3ff63f0fba2ecf59d0e9d0b7957de3d70ca38
dovecot-mysql-2.2.36-6.el7.x86_64.rpm SHA-256: d59acfd22e8b48bac8e0f6918ce7666fe87fb7e6c54622c1b0985b0de6579d6e
dovecot-pgsql-2.2.36-6.el7.x86_64.rpm SHA-256: a50387fa5d1ac48d71e126230c3a580f70651d13e3552750bc5b0797b141b1e8
dovecot-pigeonhole-2.2.36-6.el7.x86_64.rpm SHA-256: ff077d59e25427d66ee9b5efc5d306b9213bd3165d835d564761bd7818a8fb1c

Red Hat Enterprise Linux Workstation 7

SRPM
dovecot-2.2.36-6.el7.src.rpm SHA-256: c68ea97de7315ceb8e907bc5274638c67dfdfbb5ee872c7bdf9ec6acb79a7305
x86_64
dovecot-2.2.36-6.el7.i686.rpm SHA-256: 01525c5b409a4cfed6e49b9cdd63bfb658332749dc6a23c53ac71836a5b00201
dovecot-2.2.36-6.el7.x86_64.rpm SHA-256: 9f9521445ec2d4ee68a3ea930f14344aae23a990aeeb755d623329d2ccc29bcd
dovecot-debuginfo-2.2.36-6.el7.i686.rpm SHA-256: 43e14ea66b0211b82f1580980f04153cb85d2fdde70a2e6273416eac286c72ff
dovecot-debuginfo-2.2.36-6.el7.x86_64.rpm SHA-256: 1c7da0da5a94f3da2f273c19f68f07048241faf39f10f2f60b3cfef29176a9d7
dovecot-debuginfo-2.2.36-6.el7.x86_64.rpm SHA-256: 1c7da0da5a94f3da2f273c19f68f07048241faf39f10f2f60b3cfef29176a9d7
dovecot-devel-2.2.36-6.el7.x86_64.rpm SHA-256: 2615c888c3c42b5a65b8fbfce4e3ff63f0fba2ecf59d0e9d0b7957de3d70ca38
dovecot-mysql-2.2.36-6.el7.x86_64.rpm SHA-256: d59acfd22e8b48bac8e0f6918ce7666fe87fb7e6c54622c1b0985b0de6579d6e
dovecot-pgsql-2.2.36-6.el7.x86_64.rpm SHA-256: a50387fa5d1ac48d71e126230c3a580f70651d13e3552750bc5b0797b141b1e8
dovecot-pigeonhole-2.2.36-6.el7.x86_64.rpm SHA-256: ff077d59e25427d66ee9b5efc5d306b9213bd3165d835d564761bd7818a8fb1c

Red Hat Enterprise Linux for IBM z Systems 7

SRPM
dovecot-2.2.36-6.el7.src.rpm SHA-256: c68ea97de7315ceb8e907bc5274638c67dfdfbb5ee872c7bdf9ec6acb79a7305
s390x
dovecot-2.2.36-6.el7.s390.rpm SHA-256: eed9ba589570fbd3598226124b0dacda70485e166507e1f482dae8eaaf0c22d1
dovecot-2.2.36-6.el7.s390x.rpm SHA-256: d4862034a43cf69150ade77e43098bf2c3f8035f1887bbc792b726546a7e8615
dovecot-debuginfo-2.2.36-6.el7.s390.rpm SHA-256: f3cc75da291c7e529df059a7d949865435b6f232758590a059161a11c225badf
dovecot-debuginfo-2.2.36-6.el7.s390x.rpm SHA-256: 3cebe2d003f875bb6506799ed6b463b5f33b0266799ff6cb0894403e15ef2448
dovecot-debuginfo-2.2.36-6.el7.s390x.rpm SHA-256: 3cebe2d003f875bb6506799ed6b463b5f33b0266799ff6cb0894403e15ef2448
dovecot-devel-2.2.36-6.el7.s390x.rpm SHA-256: 8e1d1c255f9477b4a314b33a5aff9118ef1c7c70f797c2feb4d5418a55fd5ab7
dovecot-mysql-2.2.36-6.el7.s390x.rpm SHA-256: e85e3c94c3ab851d4d0d0ff820d57d3bf9ec3db824ef4031d1800a663c0db50b
dovecot-pgsql-2.2.36-6.el7.s390x.rpm SHA-256: ab9a974f79612557789e1ccb324a0f29242efc33fae897c37ab3b267c15b495e
dovecot-pigeonhole-2.2.36-6.el7.s390x.rpm SHA-256: 34a824b66359be60646026e6b26fa8b20cd8f608b0e8baf6e275b8c1a34a8502

Red Hat Enterprise Linux for Power, big endian 7

SRPM
dovecot-2.2.36-6.el7.src.rpm SHA-256: c68ea97de7315ceb8e907bc5274638c67dfdfbb5ee872c7bdf9ec6acb79a7305
ppc64
dovecot-2.2.36-6.el7.ppc.rpm SHA-256: 0eaabc546c54b519c937ea382445581c2eca15ebbc85220dc06a497f128c1de0
dovecot-2.2.36-6.el7.ppc64.rpm SHA-256: 4f2e098c058db4621ffb3580d735daa5f25ec841a44f806064a65b72139be03b
dovecot-debuginfo-2.2.36-6.el7.ppc.rpm SHA-256: 65378866b7c875bd0021581d3a2e6d9434d9c3e1830ae1b894b9050cc946b58a
dovecot-debuginfo-2.2.36-6.el7.ppc64.rpm SHA-256: 0506c574454cdda274380965539f8f7bbd75bda3571a81efcf14c72cf30e847e
dovecot-debuginfo-2.2.36-6.el7.ppc64.rpm SHA-256: 0506c574454cdda274380965539f8f7bbd75bda3571a81efcf14c72cf30e847e
dovecot-devel-2.2.36-6.el7.ppc64.rpm SHA-256: 6e752f4d51098e7de2ecf8b5761124b08ca2ec8ee61e3a2dfe6c62342ad6157f
dovecot-mysql-2.2.36-6.el7.ppc64.rpm SHA-256: 44f59eb3ad91cc2e0d719a80ca3cc494d781d3f8dd2eca633c2b97c0045fcbd8
dovecot-pgsql-2.2.36-6.el7.ppc64.rpm SHA-256: d1a509d99f32815c17c0b4050ba49e75e8192019e71b465a433d31bf374eeddb
dovecot-pigeonhole-2.2.36-6.el7.ppc64.rpm SHA-256: bb612de685613a2396a054b44c22b55bcb194d14f7f8f6bf8206fec10034ae85

Red Hat Enterprise Linux for Power, little endian 7

SRPM
dovecot-2.2.36-6.el7.src.rpm SHA-256: c68ea97de7315ceb8e907bc5274638c67dfdfbb5ee872c7bdf9ec6acb79a7305
ppc64le
dovecot-2.2.36-6.el7.ppc64le.rpm SHA-256: d97f8a723cbba65252e59e45de00e1364d0881c613c78b437bc2982fc0f9006a
dovecot-debuginfo-2.2.36-6.el7.ppc64le.rpm SHA-256: b984337a597d6ed3d2f9061190874cb74a3a026d6556c2fbedad618f2a63d38b
dovecot-debuginfo-2.2.36-6.el7.ppc64le.rpm SHA-256: b984337a597d6ed3d2f9061190874cb74a3a026d6556c2fbedad618f2a63d38b
dovecot-devel-2.2.36-6.el7.ppc64le.rpm SHA-256: 5522730468d5804d62845f09d403359888fd324e71146336ee82303fcde85ec2
dovecot-mysql-2.2.36-6.el7.ppc64le.rpm SHA-256: bb8732beaa23a8859e8b197457abc5e4c0d4afa42cd45657f8168ee562e68edc
dovecot-pgsql-2.2.36-6.el7.ppc64le.rpm SHA-256: 29ad8ccb1d063270de4dcab12b6cb5f000157fed6ce2b2242dc6fcbc1a334dd9
dovecot-pigeonhole-2.2.36-6.el7.ppc64le.rpm SHA-256: 0131eeaefe14c2d2b5e18007b4d8f3ceb10f1ee9fc8675b1d5e5eb521776e6be

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.