-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: dovecot security update Advisory ID: RHSA-2019:2885-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:2885 Issue date: 2019-09-23 CVE Names: CVE-2019-11500 ===================================================================== 1. Summary: An update for dovecot is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes (CVE-2019-11500) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1741141 - CVE-2019-11500 dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes 6. Package List: Red Hat Enterprise Linux Server (v. 6): Source: dovecot-2.0.9-22.el6_10.1.src.rpm i386: dovecot-2.0.9-22.el6_10.1.i686.rpm dovecot-debuginfo-2.0.9-22.el6_10.1.i686.rpm dovecot-mysql-2.0.9-22.el6_10.1.i686.rpm dovecot-pgsql-2.0.9-22.el6_10.1.i686.rpm dovecot-pigeonhole-2.0.9-22.el6_10.1.i686.rpm ppc64: dovecot-2.0.9-22.el6_10.1.ppc.rpm dovecot-2.0.9-22.el6_10.1.ppc64.rpm dovecot-debuginfo-2.0.9-22.el6_10.1.ppc.rpm dovecot-debuginfo-2.0.9-22.el6_10.1.ppc64.rpm dovecot-mysql-2.0.9-22.el6_10.1.ppc64.rpm dovecot-pgsql-2.0.9-22.el6_10.1.ppc64.rpm dovecot-pigeonhole-2.0.9-22.el6_10.1.ppc64.rpm s390x: dovecot-2.0.9-22.el6_10.1.s390.rpm dovecot-2.0.9-22.el6_10.1.s390x.rpm dovecot-debuginfo-2.0.9-22.el6_10.1.s390.rpm dovecot-debuginfo-2.0.9-22.el6_10.1.s390x.rpm dovecot-mysql-2.0.9-22.el6_10.1.s390x.rpm dovecot-pgsql-2.0.9-22.el6_10.1.s390x.rpm dovecot-pigeonhole-2.0.9-22.el6_10.1.s390x.rpm x86_64: dovecot-2.0.9-22.el6_10.1.i686.rpm dovecot-2.0.9-22.el6_10.1.x86_64.rpm dovecot-debuginfo-2.0.9-22.el6_10.1.i686.rpm dovecot-debuginfo-2.0.9-22.el6_10.1.x86_64.rpm dovecot-mysql-2.0.9-22.el6_10.1.x86_64.rpm dovecot-pgsql-2.0.9-22.el6_10.1.x86_64.rpm dovecot-pigeonhole-2.0.9-22.el6_10.1.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): i386: dovecot-debuginfo-2.0.9-22.el6_10.1.i686.rpm dovecot-devel-2.0.9-22.el6_10.1.i686.rpm ppc64: dovecot-debuginfo-2.0.9-22.el6_10.1.ppc64.rpm dovecot-devel-2.0.9-22.el6_10.1.ppc64.rpm s390x: dovecot-debuginfo-2.0.9-22.el6_10.1.s390x.rpm dovecot-devel-2.0.9-22.el6_10.1.s390x.rpm x86_64: dovecot-debuginfo-2.0.9-22.el6_10.1.x86_64.rpm dovecot-devel-2.0.9-22.el6_10.1.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: dovecot-2.0.9-22.el6_10.1.src.rpm i386: dovecot-2.0.9-22.el6_10.1.i686.rpm dovecot-debuginfo-2.0.9-22.el6_10.1.i686.rpm dovecot-mysql-2.0.9-22.el6_10.1.i686.rpm dovecot-pgsql-2.0.9-22.el6_10.1.i686.rpm dovecot-pigeonhole-2.0.9-22.el6_10.1.i686.rpm x86_64: dovecot-2.0.9-22.el6_10.1.i686.rpm dovecot-2.0.9-22.el6_10.1.x86_64.rpm dovecot-debuginfo-2.0.9-22.el6_10.1.i686.rpm dovecot-debuginfo-2.0.9-22.el6_10.1.x86_64.rpm dovecot-mysql-2.0.9-22.el6_10.1.x86_64.rpm dovecot-pgsql-2.0.9-22.el6_10.1.x86_64.rpm dovecot-pigeonhole-2.0.9-22.el6_10.1.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): i386: dovecot-debuginfo-2.0.9-22.el6_10.1.i686.rpm dovecot-devel-2.0.9-22.el6_10.1.i686.rpm x86_64: dovecot-debuginfo-2.0.9-22.el6_10.1.x86_64.rpm dovecot-devel-2.0.9-22.el6_10.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-11500 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXYkou9zjgjWX9erEAQjthQ/+LaM1fn0wXmx8OE1fVKZCmpBWXOE+VRTN 2TxEhCjemYP+cdau2CQ6+aUK0dcaBFP1p8Nerlv5qVmlJLPrCXBYZ7ExcieJx8tU x8AfnZuM5+6vfeX7D6NXInZtDwCM9ei7X1YfLnXKtN8X/xtkT7jdHMFn20YWhrqo XdO6eNmH6271DjUGeH3dnm8e51uBSAFOOxGiexX4zZnLh1bOW9ImiR4GYrEpYiws csh0X05eaTNA767xPhN/BWU5U9PKje1NKgJXFiFtizHCZ3LEAPapYvvwUy1V/xuV 3B0HVg+XoMEuoihkeWypzchtjfEKLFpmjsKjylJvqTWnOdRd7v307y9aR+Ng9Hcd i3ZPlVQ3VJ2gQ78NotgUCPyrjIj6Zbq+8b9ihJS2JdNgbrd9F0FHsAtzuR4supxU hM47yaYW+njbjMgp0vL0x16eWcW+2Sjzr9SZKETdH8sE5OyDJkc6DXSnGwH8Mxhq P0PZT4GNr1gNsAU55ZJyE54FD4pJQnogUNCw2dPgC7UmRrQjVIV1zmpHMaRnfb9J v2YuMtJuO75g4ynnwU3prcdqGiwUvXJ18snJxlMA72djoobit28He4eHJd+Xrgi5 JCnGaWNmk6p4X5Bbnt42qsv232FnBHN+aNbfea3un4s14+16AywgW9U1y1ZnF0O2 SAzgPCOIJRc= =CqWd -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce