Ilhamaf

**Name of the Vulnerable Software and Affected Versions** dovecot versions prior to 2.4.5-1.1 **Description** When IMAP compression is enabled, the compression state is reused across responses in a session. This causes response sizes to depend on both attacker-supplied mail and other mail within the same mailbox. An attacker capable of sending mail to a user and observing the sizes of that user's IMAP traffic can confirm if the body of a small message matches a guessed text. This can disclose whether a secret-like message body matches a candidate text. **Recommendations** Update to version 2.4.5-1.1. Disable IMAP compression.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. **Description** No information is available regarding the nature of this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** dovecot versions prior to 2.4.5-1.1 **Description** A host configured as a trusted proxy can send forwarding information containing a NUL byte. This causes the login process to crash during the subsequent login attempt, leading to process termination and potential denial of service for login functionality. This issue only affects deployments where trusted proxies are configured. **Recommendations** Update to version 2.4.5-1.1. Restrict the list of trusted proxy networks to hosts that are fully under your control.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Insufficient validation of names occurs during AXFR (Asynchronous Full Transfer), a mechanism used by DNS servers to replicate zone data from a primary server to a secondary server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Insufficient validation of member zone data may cause the catalog zone transfer to fail. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.