+++ This bug was initially created as a clone of Bug #436287 +++ Description of problem: The file dovecot.conf is world readable by default. This poses a potential security issue if the ssl_key_password parameter is set. Any local user would be able to view the password used to protect the SSL key file. The dovecot.conf file does not need to be world readable, dovecot functions perfectly well with /etc/dovecot.conf not being world readable. Changing the default permissions of dovecot.conf to -rw-r---- (0640) would prevent this issue and has no impact on system functionality. Version-Release number of selected component (if applicable): How reproducible: Always Steps to Reproduce: 1. install dovecot 2. 3. Actual results: Expected results: Additional info:
Changing version to '9' as part of upcoming Fedora 9 GA. More information and reason for this action is here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping
dovecot-1.0.14-7.fc9 has been submitted as an update for Fedora 9
dovecot-1.0.14-7.fc8 has been submitted as an update for Fedora 8
So now that this is fixed in Fedora any plans for Enterprise?
It should be fixed in the next batch update for RHEL5 (5.3) along with other bugs reported for dovecot.