dovecot security update

CentOS Errata and Security Advisory CESA-2020:1062

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

• dovecot: Improper certificate validation (CVE-2019-3814)

• dovecot: Buffer overflow in indexer-worker process results in privilege escalation (CVE-2019-7524)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes linked from the References section.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-cr-announce/2020-April/032503.html

Affected packages:
dovecot
dovecot-devel
dovecot-mysql
dovecot-pgsql
dovecot-pigeonhole

Upstream details at:
https://access.redhat.com/errata/RHSA-2020:1062