48 matches found
Astra Linux – vulnerability in dovecot
Doveadm credentials are verified via direct comparison, which is vulnerable to timing oracle attacks. An attacker can exploit this to determine the configured credentials. Knowing these credentials grants full access to the affected component. Access to the Doveadm HTTP service port must be...
Rocky Linux 9.6 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1778220630)
The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778220630 advisory. - Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is...
AlmaLinux 9.2 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778573628)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778573628 advisory. - Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is...
CVE-2026-42393
A flaw was found in dovecot. The comparison mechanism for doveadm passwords and API keys is not fully timing safe. A remote attacker, with network access to the doveadm service, could repeatedly make requests and accurately measure response timings. This could allow the attacker to learn the leng...
SUSE CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
Linux Distros Unpatched Vulnerability : CVE-2026-42393
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to...
ALPINE-CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
AZL-98310 CVE-2026-42393 affecting package dovecot 2.3.20-1
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
CVE-2026-42393
CVE-2026-42393 affects the doveadm service in Open-Xchange's Dovecot implementation. The password and API key comparison is not fully timing-safe, allowing a network-adjacent attacker who can make repeated requests and accurately measure response times to learn the length of the configured secret...
CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
EUVD-2026-67676
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
CVE-2026-42393: Exposure of Sensitive Information to an Unauthorized Actor
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
UBUNTU-CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...
PT-2026-83069
Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description The comparison process for the doveadm password and API key is not fully timing safe. This allows an attacker on the same network as the doveadm service to determine the length of the configured...