Debian/dovecot: low 3.1
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service
Action: Upgrade dovecot to 1:2.4.5+dfsg1-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1:2.4.5+dfsg1-1 | - |
Fixed versions
| 1:2.4.5+dfsg1-1 |
Sources
- osv: DEBIAN-CVE-2026-42393#Debian:14/dovecot
- https://security-tracker.debian.org/tracker/CVE-2026-42393
published · modified · JSON