CVE-2011-4318
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows…
Does this matter?
Lower severity and a low EPSS score (1.32%). Track it; it rarely justifies an emergency change on its own.
Description
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.
- CVSS 2.0
- 5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
- EPSS
- 1.32% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- dovecot/dovecot
- Source
- secalert@redhat.com
References
- http://hg.dovecot.org/dovecot-2.0/rev/5e9eaf63a6b1
- http://rhn.redhat.com/errata/RHSA-2013-0520.htmlVendor Advisory
- http://secunia.com/advisories/46886
- http://secunia.com/advisories/52311Vendor Advisory
- http://www.dovecot.org/list/dovecot-news/2011-November/000200.html
- http://www.openwall.com/lists/oss-security/2011/11/18/5
- http://www.openwall.com/lists/oss-security/2011/11/18/7
- https://bugs.gentoo.org/show_bug.cgi?id=390887
- https://bugzilla.redhat.com/show_bug.cgi?id=754980
- http://hg.dovecot.org/dovecot-2.0/rev/5e9eaf63a6b1
- http://rhn.redhat.com/errata/RHSA-2013-0520.htmlVendor Advisory
- http://secunia.com/advisories/46886
- http://secunia.com/advisories/52311Vendor Advisory
- http://www.dovecot.org/list/dovecot-news/2011-November/000200.html
- http://www.openwall.com/lists/oss-security/2011/11/18/5
- http://www.openwall.com/lists/oss-security/2011/11/18/7
- https://bugs.gentoo.org/show_bug.cgi?id=390887
- https://bugzilla.redhat.com/show_bug.cgi?id=754980
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.