CVE-2019-3814

2019-02-0500:00:00

ubuntu.com

CVSS2

4.9

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

EPSS

0.003

Percentile

69.4%

JSON

It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1
incorrectly handled client certificates. A remote attacker in possession of
a valid certificate with an empty username field could possibly use this
issue to impersonate other users.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchdovecot< 1:2.2.33.2-1ubuntu4.2UNKNOWN
ubuntu18.10noarchdovecot< 1:2.3.2.1-1ubuntu3.1UNKNOWN
ubuntu14.04noarchdovecot< 1:2.2.9-1ubuntu2.5UNKNOWN
ubuntu16.04noarchdovecot< 1:2.2.22-1ubuntu2.9UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	dovecot	< 1:2.2.33.2-1ubuntu4.2	UNKNOWN
ubuntu	18.10	noarch	dovecot	< 1:2.3.2.1-1ubuntu3.1	UNKNOWN
ubuntu	14.04	noarch	dovecot	< 1:2.2.9-1ubuntu2.5	UNKNOWN
ubuntu	16.04	noarch	dovecot	< 1:2.2.22-1ubuntu2.9	UNKNOWN