Debian/dovecot: medium 5.9
Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring out the credential wil
Action: Upgrade dovecot to 1:2.4.1+dfsg1-6+deb13u4 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1:2.4.1+dfsg1-6+deb13u4 | - |
Fixed versions
| 1:2.4.1+dfsg1-6+deb13u4 |
Sources
- osv: DEBIAN-CVE-2026-27856#Debian:13/dovecot
- https://security-tracker.debian.org/tracker/CVE-2026-27856
published · modified · JSON