Debian/dovecot: medium 5.9
Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP re
Action: Upgrade dovecot to 1:2.4.1+dfsg1-6+deb13u4 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1:2.4.1+dfsg1-6+deb13u4 | - |
Fixed versions
| 1:2.4.1+dfsg1-6+deb13u4 |
Sources
- osv: DEBIAN-CVE-2026-27855#Debian:13/dovecot
- https://security-tracker.debian.org/tracker/CVE-2026-27855
published · modified · JSON