oss-security - CVE Request (dovecot)

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 29 Oct 2008 14:30:36 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security <oss-security@...ts.openwall.com>
Cc: coley@...re.org
Subject: CVE Request (dovecot)

I'm not sure if this is a Red Hat specific issue, but I figured I'd mention it here:
It seems dovecot can have an SSL key file password disclosure issue:
https://bugzilla.redhat.com/show_bug.cgi?id=436287

Basically, if your dovecot.conf file is world readable and you have your SSL key
password in it, anyone can see it.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.