PT-2019-1772 · Dovecot+5 · Dovecot+5

Halfdog · Published 2019-02-05 · Updated 2025-01-30 · CVE-2019-3814

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.2.36.1 Dovecot versions prior to 2.3.4.1

Description The issue is related to errors in certificate authentication. A remote attacker with a valid certificate that has an empty username field could potentially use this to impersonate other users. This could allow an unauthorized access to protected information.

Recommendations For versions prior to 2.2.36.1, update to version 2.2.36.1 or later. For versions prior to 2.3.4.1, update to version 2.3.4.1 or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2019-1512

BDU:2019-01416

CESA-2019_3467

CESA-2020_1062

CVE-2019-3814

DLA-1667-1

DSA-4385-1

MGASA-2019-0072

OPENSUSE-SU-2019:0243-1

OPENSUSE-SU-2019_0243-1

OPENSUSE-SU-2019_1220-1

OPENSUSE-SU-2024:10726-1

OPENSUSE-SU-2025:14715-1

RHSA-2019:3467

RHSA-2019_3467

RHSA-2020:1062

RHSA-2020_1062

SUSE-SU-2019:0414-1

SUSE-SU-2019:0900-1

SUSE-SU-2019_0414-1

SUSE-SU-2019_0900-1

USN-3881-1

USN-3881-2

Affected Products

Alt Linux

Centos

Dovecot

Red Hat

Suse

Ubuntu

References · 92

• 🔥 https://dovecot.org/list/dovecot/2019-February/114575.html · Exploit
• https://advisories.mageia.org/MGASA-2019-0072.html · Security Note
• https://errata.altlinux.org/ALT-PU-2019-1512 · Vendor Advisory
• https://security.gentoo.org/glsa/201904-19 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=57444186 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4385-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0900-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14715-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0072 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3814 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-3814 · Security Note
• https://security-tracker.debian.org/tracker/DLA-1667-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10726-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3881-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-1062.html · Vendor Advisory