[CLSA-2026:1787230282] dovecot: Fix of CVE-2026-0394
Type:
security
Severity:
Moderate
Release date:
2026-08-20 12:51:33 UTC
Description:
- CVE-2026-0394: auth: db-passwd-file: reject passwd-file paths that escape the configured prefix after variable expansion
CVEs fixed:
Updated packages:
  • dovecot-2.3.16-15.el9.tuxcare.els4.i686.rpm
    sha:3dab0e70b8724d65b9349503fad3c3e1908ba0df307664810078bced7e19cbdf
  • dovecot-2.3.16-15.el9.tuxcare.els4.x86_64.rpm
    sha:2d7816799f0449138346690dc66cbf86b566ffe7dffc72f79e30f092f605f9d0
  • dovecot-devel-2.3.16-15.el9.tuxcare.els4.i686.rpm
    sha:fbb4dd64bfcd97dcaf739311fa0bc849a10db1cd1101c6a5f7b6fc9938971874
  • dovecot-devel-2.3.16-15.el9.tuxcare.els4.x86_64.rpm
    sha:01f0fc9362b25f353131fcc0ea6a1a2aca67237df5c7a3aeb00459a1d3363ea2
  • dovecot-mysql-2.3.16-15.el9.tuxcare.els4.x86_64.rpm
    sha:cdb6b8cbe9fc2b8d6d6e8aaddd09f67b6b95f3891424592054757810926a12ff
  • dovecot-pgsql-2.3.16-15.el9.tuxcare.els4.x86_64.rpm
    sha:cf520d9df183572acb117b103cbbe16b5f48dd4e3745617628f8f6365bc57f44
  • dovecot-pigeonhole-2.3.16-15.el9.tuxcare.els4.x86_64.rpm
    sha:14b125ba0be411fd4e558a2d26f8a76fbeeb65c5c1ee2093ff45b1c7ec3d400b
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.