-------------------------------------------------------------------------------
-
Fedora Update Notification
FEDORA-2018-52d79f4f36
2018-04-01 20:13:09.729581
-------------------------------------------------------------------------------
-

Name        : dovecot
Product     : Fedora 27
Version     : 2.2.34
Release     : 1.fc27
URL         : http://www.dovecot.org/
Summary     : Secure imap and pop3 server
Description :
Dovecot is an IMAP server for Linux/UNIX-like systems, written with security
primarily in mind.  It also contains a small POP3 server.  It supports mail
in either of maildir or mbox formats.

The SQL drivers and authentication plug-ins are in their subpackages.

-------------------------------------------------------------------------------
-
Update Information:

    dovecot updated to 2.2.34, pigeonhole updated to 0.4.22     fixes
CVE-2017-15130: TLS SNI config lookups may lead to excessive       memory
 usage,
causing imap-login/pop3-login VSZ limit to be reached       and the process
restarted. This happens only if Dovecot config has       local_name { } or
 local
{ } configuration blocks and attacker uses       randomly generated SNI
servernames.     fixes CVE-2017-14461: Parsing invalid email addresses may
 cause
a crash or       leak memory contents to attacker. For example, these memory
contents       might contain parts of an email from another user if the same
imap       process is reused for multiple users.     fixes CVE-2017-15132:
Aborted SASL authentication leaks memory in login       process.
-------------------------------------------------------------------------------
-
References:

  [ 1 ] Bug #1550508 - CVE-2017-14461 dovecot: Information Leak Vulnerability
 in rfc822_parse_domain leading to denial-of-service [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1550508
  [ 2 ] Bug #1538717 - CVE-2017-15132 dovecot: Auth leaks memory if SASL
 authentication is aborted [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1538717
-------------------------------------------------------------------------------
-

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade dovecot' at the command line.
For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
-------------------------------------------------------------------------------
-
_______________________________________________
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org