PT-2026-28364 · Doveadm+4 · Doveadm+4
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Doveadm (affected versions not specified)
Description
Doveadm credentials are verified using direct comparison, which is susceptible to a timing oracle attack. An attacker could potentially determine the configured credentials, leading to full access to the affected component.
Recommendations
Limit access to the doveadm http service port.
Install the fixed version dovecot24-2.4.3-1.1.
Exploit
Correção
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Doveadm
Dovecot
Linuxmint
Red Os
Ubuntu