# \[PSA\] Dovecot Security Vulnerability

**URL:** <https://discourse.mailinabox.email/t/psa-dovecot-security-vulnerability/4833>\
**Category:** Announcements\
**Created:** [April 1, 2019, 4:45pm UTC](https://discourse.mailinabox.email/t/psa-dovecot-security-vulnerability/4833 "2019-04-01T16:45:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eliter](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/e/74df32/32.png) [@Eliter](https://discourse.mailinabox.email/u/Eliter)\
**Post date:** [April 1, 2019, 4:45pm UTC](https://discourse.mailinabox.email/t/psa-dovecot-security-vulnerability/4833/1 "2019-04-01T16:45:20Z")

</div>

Short version of the story: upgrade Dovecot (sudo apt-get update; sudo apt-get upgrade dovecot-core).

I am on the Ubuntu security mailing list, where the email people all the security vulnerabilities. There’s apparently a way to mess with POP3/FTS headers with Dovecot to escalate to root privileges and execute arbitrary code. But “[o]nly installations using the FTS or pop3 migration plugins are affected.” Not sure if MIAB uses any POP3 migration plugins though.

I thought I would share this interesting information with you guys. I don’t know too much about this stuff, so it could just me talking out of ignorance. But I thought I could also mention while I am at it, Canonical is going to no longer support Ubuntu LTS 14.04 starting 30 April 2019. Security vulnerabilities get missed all the time, it’s just a matter of patching them. Once you stop patching them, attackers start to get the advantage.

That said, be sure to upgrade your Mail-in-a-Box machines to Ubuntu LTS 18.04, if you have not already done so. Time is running out.

Here’s the information:  
[https://usn.ubuntu.com/usn/usn-3928-1](https://usn.ubuntu.com/usn/usn-3928-1)  
Ubuntu: CVE-2019-7524  
Debian: [https://security-tracker.debian.org/tracker/CVE-2019-7524](https://security-tracker.debian.org/tracker/CVE-2019-7524)  
Priority: medium  
(medium: “Open vulnerability that is a real problem and is exploitable for many users of the affected software. Examples include network daemon denial of service, cross-site scripting and gaining user privileges.”)

---

<div class="post-metadata">

**Author:** ![JoshData](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/joshdata/32/2153_2.png) [@JoshData](https://discourse.mailinabox.email/u/JoshData)\
**Post date:** [April 1, 2019, 6:54pm UTC](https://discourse.mailinabox.email/t/psa-dovecot-security-vulnerability/4833/2 "2019-04-01T18:54:29Z")

</div>

Thanks. Mail-in-a-Box is likely affected. (Starting with v0.40 we don’t have FTS enabled, but all versions have had POP3 enabled.)

Since we have security updates installed automatically, I think everyone will get the fix within a day.

When I run:

```auto
dpkg -s dovecot-core | grep ^Version

```

I currently get version 1:2.2.33.2-1ubuntu4.2.

According to the Ubuntu link above, the fixed version is 1:2.2.33.2-1ubuntu4. **3**. Maybe in a few hours my box will install it…

---

<div class="post-metadata">

**Author:** ![JoshData](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/joshdata/32/2153_2.png) [@JoshData](https://discourse.mailinabox.email/u/JoshData)\
**Post date:** [April 3, 2019, 10:41am UTC](https://discourse.mailinabox.email/t/psa-dovecot-security-vulnerability/4833/3 "2019-04-03T10:41:10Z")

</div>

This morning my box has the latest version of `dovecot-core` (I didn’t do any manual upgrades) so I think we’re all set with the automatic update.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.mailinabox.email/uploads/default/original/2X/4/4d0933d13c456b7e57f296aa6cc344525b6f0c70.png) [@system](https://discourse.mailinabox.email/u/system)\
**Post date:** [April 9, 2019, 10:41am UTC](https://discourse.mailinabox.email/t/psa-dovecot-security-vulnerability/4833/4 "2019-04-09T10:41:16Z")

</div>

This topic was automatically closed 6 days after the last reply. New replies are no longer allowed.