Bug 439369

Summary:	new dovecot security issues from the dovecot site
Product:	Red Hat Enterprise Linux 5	Reporter:	Johnny Hughes <johnny>
Component:	dovecot	Assignee:	Dan Horák <dhorak>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	5.1	CC:	thoger
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-01-20 22:00:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Johnny Hughes 2008-03-28 10:42:22 UTC

Dovecot has released 2 public e-mails detailing 2 security issues in dovecot
version 1.0.x

The first one seems to not be patchable, but a user setup issue (probably no
action required in packaging):
http://www.dovecot.org/list/dovecot-news/2008-March/000060.html

The second one seems to have fixes incorporated into the latest release:
http://www.dovecot.org/list/dovecot-news/2008-March/000064.html

Comment 1 RHEL Program Management 2008-06-04 22:45:46 UTC

This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 2 Dan Horák 2008-06-09 13:03:05 UTC

The first was already submitted as bug #437152 and is fixed in RHEL 5.2.
The second one is also known as CVE-2008-1218.

Comment 5 Tomas Hoger 2008-10-03 10:11:33 UTC

CVE-2008-1218 was tracked via bug #436928, which also explains why it was not handled as a security issue.

Comment 8 errata-xmlrpc 2009-01-20 22:00:41 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2009-0205.html