Package "dovecot"

Name: dovecot


This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • secure POP3/IMAP server - Lua authentication plugin
  • secure POP3/IMAP server - GSSAPI support
  • secure POP3/IMAP server - LDAP support
  • secure POP3/IMAP server - LMTP server

Latest version: 1:
Release: groovy (20.10)
Level: security
Repository: universe


Other versions of "dovecot" in Groovy

Repository Area Version
base universe 1:
base main 1:
security main 1:
updates main 1:
updates universe 1:

Packages in group

Deleted packages are displayed in grey.


Version: 1: 2021-06-21 15:06:41 UTC

  dovecot (1: groovy-security; urgency=medium

  * SECURITY UPDATE: incorrectly escapes kid and azp fields in JWT tokens
    - debian/patches/CVE-2021-29157.patch: improve escaping in
      src/lib-dict-extra/dict-fs.c, src/lib-oauth2/oauth2-jwt.c,
    - CVE-2021-29157
  * SECURITY UPDATE: plaintext command injection before STARTTLS
    - debian/patches/CVE-2021-33515.patch: properly handle command queue in
    - CVE-2021-33515

 -- Marc Deslauriers <email address hidden> Wed, 16 Jun 2021 09:09:18 -0400

Source diff to previous version
CVE-2021-29157 oauth2 JWT local validation path traversal
CVE-2021-33515 SMTP Submission service STARTTLS injection

Version: 1: 2021-01-04 15:07:31 UTC

  dovecot (1: groovy-security; urgency=medium

  * SECURITY UPDATE: information disclosure via imap hibernation
    - debian/patches/CVE-2020-24386-1.patch: escape tag when sending it to
      imap-hibernate process in src/imap/imap-client-hibernate.c.
    - debian/patches/CVE-2020-24386-2.patch: add unit test for
      imap-client-hibernate in src/imap/Makefile.am,
      src/imap/imap-client-hibernate.c, src/imap/imap-client.h,
    - CVE-2020-24386
  * SECURITY UPDATE: remote DoS via large number of MIME parts
    - debian/patches/CVE-2020-25275-1.patch: fix assert-crash when
      enforcing MIME part limit in src/lib-mail/message-parser.c,
    - debian/patches/CVE-2020-25275-2.patch: don't generate invalid
      BODYSTRUCTURE when reaching MIME part limit in
    - CVE-2020-25275

 -- Marc Deslauriers <email address hidden> Mon, 28 Dec 2020 10:59:24 -0500

About   -   Send Feedback to @ubuntu_updates