Debian/dovecot: low 3.1
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service
Action: Upgrade dovecot to 1:2.3.19.1+dfsg1-2.1+deb12u7 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1:2.3.19.1+dfsg1-2.1+deb12u7 | - |
Fixed versions
| 1:2.3.19.1+dfsg1-2.1+deb12u7 |
Sources
published · modified · JSON