[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2026-42392/dovecot: Triage for bookworm

[Guilhem Moulin (@guilhem)]

Guilhem Moulin pushed to branch master at Debian Security Tracker / security-tracker


Commits:
5a492fae by Guilhem Moulin at 2026-09-27T21:21:27+02:00
CVE-2026-42392/dovecot: Triage for bookworm

And add link to commit referencing the issue

- - - - -
2b28f106 by Guilhem Moulin at 2026-09-27T21:21:28+02:00
CVE-2026-40016/dovecot: Drop incorrect bullseye triaging

This reverts 63da12e856d53905f07acb2a6782c01f67ce8ad3.  Sieve resource
usage tracking was added in 2.3.15 as a fix for CVE-2020-28200, so the
resource limit bypass don't affect versions earlier versions for which
the fix was not backported.  This should therefore be <not-affected>
instead.  Since bullseye is now ELTS, drop the the trigage here so it
can be set in the ELTS tracker.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -37215,8 +37215,10 @@ CVE-2026-42393 (The comparison used for the doveadm password and API key is not
 	NOTE: Fixed by: https://github.com/dovecot/core/commit/647e76a865ba173f6182e211c57ec3c2942a6b04
 CVE-2026-42392 (An attacker that has valid credentials can send an invalid IMAP URLFET ...)
 	- dovecot 1:2.4.5+dfsg1-1 (bug #1146018)
+	[bookworm] - dovecot <not-affected> (Vulnerable code not present, introduced in 2.4.0)
 	NOTE: https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html#cve-2026-42392-imap-urlauth-leaks-memory-into-user-visible-error-messages
 	NOTE: Fixed by: https://github.com/dovecot/core/commit/48d8141049f7150a0469a4efe68669fbf8bcbb24
+	NOTE: Introduced with: https://github.com/dovecot/core/commit/bb193c273e63ffa42c5c0b51ecd8860398e3beab (2.4.0)
 CVE-2026-42391 (An unauthenticated attacker can send an IMAP ID command with a very la ...)
 	- dovecot 1:2.4.5+dfsg1-1 (bug #1146018)
 	NOTE: https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html#cve-2026-42391-imap-pre-login-memory-cpu-growth-with-id-command
@@ -136236,7 +136238,6 @@ CVE-2026-40020 (Attacker can use the IMAP SETACL command to inject the anyone pe
 CVE-2026-40016 (Attacker can upload a malicious Sieve script over ManageSieve service  ...)
 	{DSA-6313-1}
 	- dovecot 1:2.4.4+dfsg1-1 (bug #1136444)
-	[bullseye] - dovecot <ignored> (Minor issue, backport is too disruptive)
 	NOTE: https://www.openwall.com/lists/oss-security/2026/05/12/6
 	NOTE: Fixed by: https://github.com/dovecot/pigeonhole/commit/5b0ed9d1034c023d3daf218b6b8656f0cdd383dc (2.4.4)
 CVE-2026-3604 (The WP SEO Structured Data Schema plugin for WordPress is vulnerable t ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/883f25aae555101ed9d9486ec3e565e66064b84a...2b28f1065d0988e72fe5d12ff038b50919ad6cb0

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/883f25aae555101ed9d9486ec3e565e66064b84a...2b28f1065d0988e72fe5d12ff038b50919ad6cb0
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260927/4926c436/attachment-0001.htm>