PT-2026-28368 · Dovecot+2 · Dovecot+2

Cookiejack15 · Publicado 2026-01-01 · Atualizado 2026-04-16 · CVE-2026-27860

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.4.3

Description If the auth username chars setting is empty, an attacker can inject arbitrary LDAP filters into Dovecot's LDAP authentication process. This can bypass restrictions and allow probing of the LDAP structure. No publicly available exploits are known.

Recommendations Do not clear out the auth username chars setting. Install version 2.4.3 or later.

Correção

Enumeração de Fraquezas

CWE-90

Identificadores relacionados

CVE-2026-27860

OPENSUSE-SU-2026:10442-1

OPENSUSE-SU-2026:20554-1

SUSE-SU-2026:21208-1

USN-8136-1

Produtos afetados

Dovecot

Linuxmint

Ubuntu

Referências · 46

• https://osv.dev/vulnerability/openSUSE-SU-2026:10442-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2025-59028 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-27857 · Nota
• https://ubuntu.com/security/CVE-2026-24031 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-27860 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27860 · Nota de Segurança
• https://security.alpinelinux.org/vuln/CVE-2026-27860 · Nota
• https://bugzilla.suse.com/1260900 · Nota
• https://twitter.com/CVEnew/status/2037513351983444281 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-27859 · Nota
• https://bugzilla.suse.com/1260899 · Nota
• https://suse.com/security/cve/CVE-2026-27855 · Nota
• https://bugzilla.suse.com/1260901 · Nota
• https://suse.com/security/cve/CVE-2025-59032 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2026:21208-1 · Aviso do Fabricante