CVE-2011-4318
published 2013-03-07CVE-2011-4318: Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname…
PriorityP423medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EPSS
1.32%
67.9th percentile
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | dovecot | < dovecot 1:2.0.18-1 (bookworm) | dovecot 1:2.0.18-1 (bookworm) |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | — | — |
| dovecot | dovecot | >= 0 < 1:2.0.18-1 | 1:2.0.18-1 |
| dovecot | dovecot | >= 0 < 1:2.0.18-1 | 1:2.0.18-1 |
| dovecot | dovecot | >= 0 < 1:2.0.18-1 | 1:2.0.18-1 |
| dovecot | dovecot | >= 0 < 1:2.0.18-1 | 1:2.0.18-1 |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
osv5.8MEDIUM
vendor_debian5.8LOW
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Dovecot vulnerability
vendor_ubuntu·2011-12-08
CVE-2011-4318 Dovecot vulnerability
Title: Dovecot vulnerability
Summary: Dovecot could be made to expose sensitive information over the network.
It was discovered that Dovecot incorrectly validated certificate hostnames
when being used as a POP3 and IMAP proxy. If a remote attacker were able to
perform a machine-in-the-middle attack, this flaw could be exploited to view
sensitive information.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
dovecot: proxy destination host name not checked against SSL certificate name
vendor_redhat·2011-11-17·CVSS 5.8
CVE-2011-4318 [MEDIUM] dovecot: proxy destination host name not checked against SSL certificate name
dovecot: proxy destination host name not checked against SSL certificate name
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.
Package: dovecot (Red Hat Enterprise Linux 4) - Not affected
Package: dovecot (Red Hat Enterprise Linux 5) - Not affected
Debian
CVE-2011-4318: dovecot - Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is use...
vendor_debian·2011·CVSS 5.8
CVE-2011-4318 [MEDIUM] CVE-2011-4318: dovecot - Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is use...
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.
Scope: local
bookworm: resolved (fixed in 1:2.0.18-1)
bullseye: resolved (fixed in 1:2.0.18-1)
forky: resolved (fixed in 1:2.0.18-1)
sid: resolved (fixed in 1:2.0.18-1)
trixie: resolved (fixed in 1:2.0.18-1)
GHSA
GHSA-w2rf-p589-jpp8: Dovecot 2
ghsa_unreviewed·2022-05-17
CVE-2011-4318 [MEDIUM] CWE-20 GHSA-w2rf-p589-jpp8: Dovecot 2
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.
OSV
CVE-2011-4318: Dovecot 2
osv·2013-03-07·CVSS 5.8
CVE-2011-4318 [MEDIUM] CVE-2011-4318: Dovecot 2
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.
No detection rules found.
No public exploits indexed.
http://hg.dovecot.org/dovecot-2.0/rev/5e9eaf63a6b1http://rhn.redhat.com/errata/RHSA-2013-0520.htmlhttp://secunia.com/advisories/46886http://secunia.com/advisories/52311http://www.dovecot.org/list/dovecot-news/2011-November/000200.htmlhttp://www.openwall.com/lists/oss-security/2011/11/18/5http://www.openwall.com/lists/oss-security/2011/11/18/7https://bugs.gentoo.org/show_bug.cgi?id=390887https://bugzilla.redhat.com/show_bug.cgi?id=754980http://hg.dovecot.org/dovecot-2.0/rev/5e9eaf63a6b1http://rhn.redhat.com/errata/RHSA-2013-0520.htmlhttp://secunia.com/advisories/46886http://secunia.com/advisories/52311http://www.dovecot.org/list/dovecot-news/2011-November/000200.htmlhttp://www.openwall.com/lists/oss-security/2011/11/18/5http://www.openwall.com/lists/oss-security/2011/11/18/7https://bugs.gentoo.org/show_bug.cgi?id=390887https://bugzilla.redhat.com/show_bug.cgi?id=754980
2013-03-07
Published