a30d577a4b
Fixes the following security issues: * CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field (ssl_cert_username_field), under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing. * ssl_cert_username_field setting was ignored with external SMTP AUTH, because none of the MTAs (Postfix, Exim) currently send the cert_username field. This may have allowed users with trusted certificate to specify any username in the authentication. This bug didn't affect Dovecot's Submission service. For more details, see the announcement: https://www.dovecot.org/list/dovecot-news/2019-February/000394.html Signed-off-by: Peter Korsgaard <peter@korsgaard.com> |
||
|---|---|---|
| .. | ||
| 0001-byteorder.h-fix-uclibc-build.patch | ||
| Config.in | ||
| dovecot.hash | ||
| dovecot.mk | ||