mailinabox

Mail-in-a-Box By @JoshData and contributors. Mail-in-a-Box helps individuals take back control of their email by defining a one-click, easy-to-deploy SMTP+everything else server: a mail server in a box. Please seehttps://mailinabox.email for the project's website and setup guide! Our goals are to...

CVE-2026-24031

CVE-2026-24031: Bypass de autenticación SQL en Dovecot autenticación + enumeración de usuarios Este repositorio contiene un exploit de prueba de concepto para eludir la autenticación de CVE-2026-24031 , una inyección SQL en la autenticación basada en SQL de Dovecot introducida como regresión en...

Linux Distros Unpatched Vulnerability : CVE-2026-42394

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - dovecot - None Ubuntu Linux - sieve: symlink traversal flaw could result in arbitrary file disclosure CVE-2026-42394 Note that Nessus relies on t...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: dovecot (UTSA-2026-090084)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090084 advisory. In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read. Tenable has extracted the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: dovecot (UTSA-2026-090119)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090119 advisory. In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: dovecot (UTSA-2026-090074)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090074 advisory. In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service resource consumption via a craft...

[SECURITY] Fedora 44 Update: dovecot-2.4.5-1.fc44

Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are in their subpackages...

[SECURITY] Fedora 43 Update: dovecot-2.4.5-1.fc43

Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are in their subpackages...

[SECURITY] Fedora 45 Update: dovecot-2.4.5-1.fc45

Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are in their subpackages...

Fedora 44 : dovecot (2026-2e6b786570)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2e6b786570 advisory. - updated to 2.4.5, many security fixes Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora 43 : dovecot (2026-e8a6485109)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e8a6485109 advisory. - updated to 2.4.5, many security fixes Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora 45 : dovecot (2026-8b8efbd2b8)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8b8efbd2b8 advisory. - updated to 2.4.5, many security fixes Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Astra Linux – Vulnerability in dovecot

The attacker can use a specially crafted Base64 exchange between Dovecot and the client to forge SCRAM TLS channel bindings. This requires that the attacker be able to position themselves between Dovecot and the client connection. If successful, the attacker can eavesdrop on communications betwee...

Astra Linux – Vulnerability in dovecot

Dovecot OTP authentication is vulnerable to replay attacks under certain conditions. If the auth cache is enabled, and the username is changed in passdb, then the OTP credentials can be cached, making the same OTP response valid. An attacker who can observe the OTP exchange can log in as the user...

Astra Linux – Vulnerability in dovecot

The attacker can use the IMAP SETACL command to inject the “anyone” permission into the user’s dovecot-acl file, even if imapaclallowanyone is set to “no”. This causes folders to be sent to all users. The impact is limited to being able to send folders to other users; no unexpected access is...

Astra Linux – Vulnerability in dovecot

A issue was discovered in the auth component of Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect usernamefilter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead ...

Astra Linux – Vulnerability in dovecot

The ManageSieve AUTHENTICATE command crashes when using “literal” as the initial response to SASL. This can be used to repeatedly crash the ManageSieve service, rendering it unavailable to other users. It’s recommended to control access to the ManageSieve port or disable the service if it’s not...

Astra Linux – Vulnerability in dovecot

Sending the “NOOP ...” command with 4000 opening and closing parentheses results in an additional 1MB of memory usage. Longer commands will cause the client to disconnect. This 1MB of memory can be reserved for longer periods of time by not sending the command that ends with LF. Thus, an attacker...

Astra Linux – Vulnerability in dovecot

Doveadm credentials are verified through direct comparison, which is vulnerable to timing oracle attacks. An attacker can use this vulnerability to determine the configured credentials. Identifying these credentials allows them to gain full access to the affected component. Limit access to the...

Astra Linux – Vulnerability in dovecot

The Sieve engine in Dovecot before 2.3.15 allowed uncontrolled resource consumption, as demonstrated by a situation involving a complex regular expression for the regex extension...