The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) by aborting authentication without setting a username.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0035 advisory.

    This advisory aggregates security fixes for the dovecot SRPM in CIQ LTS 8.6. It addresses 21 CVEs:
    CVE-2019-11500, CVE-2020-24386, CVE-2020-25275, CVE-2020-12100, CVE-2017-14461, and 16 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Fixed crash in auth process when auth-policy was     configured and authentication was aborted/failed without     a username set.

  - director: If two users had different tags but the same     hash, the users may have been redirected to the wrong     tag's hosts.

  - Index files may have been thought incorrectly lost,     causing 'Missing middle file seq=..' to be logged and     index rebuild. This happened more easily with IMAP     hibernation enabled.

  - Various fixes to restoring state correctly in     un-hibernation.

  - dovecot.index files were commonly 4 bytes per email too     large. This is because 3 bytes per email were being     wasted that could have been used for IMAP keywords.

  - Various fixes to handle dovecot.list.index corruption     better.

  - lib-fts: Fixed assert-crash in address tokenizer with     specific input.

  - Fixed assert-crash in HTML to text parsing with specific     input (e.g. for FTS indexing or snippet generation)

  - doveadm sync -1: Fixed handling mailbox GUID conflicts.

  - sdbox, mdbox: Perform full index rebuild if corruption     is detected inside lib-index, which runs index fsck.

  - quota: Don't skip quota checks when moving mails between     different quota roots.

  - search: Multiple sequence sets or UID sets in search     parameters weren't handled correctly. They were     incorrectly merged together.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
357898	Rocky Linux 8.6 [CIQ] Security Update: dovecot / dovecot-debuginfo / dovecot-debugsource / dovecot-devel / etc Multiple Vulnerabilities (ciqsa-2026_0035)	Nessus	Rocky Linux Local Security Checks	Local	critical
96218	Fedora 25 : 1:dovecot (2016-daf90926d4)	Nessus	Fedora Local Security Checks	Local	medium
96057	Fedora 24 : 1:dovecot (2016-bb22a24d3d)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2016-8652

medium

Tenable Plugins

critical

medium

medium