PT-2026-28364 · Doveadm+4 · Doveadm+4
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Doveadm (affected versions not specified)
Description
Doveadm credentials are verified using direct comparison, which is susceptible to a timing oracle attack. An attacker could potentially determine the configured credentials, leading to full access to the affected component.
Recommendations
Limit access to the doveadm http service port.
Install the fixed version dovecot24-2.4.3-1.1.
Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Doveadm
Dovecot
Linuxmint
Red Os
Ubuntu