CVE-2026-27860
If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2026-27860 dovecot Corrigé dans: 2.4.3-r0
- Debian DEBIAN-CVE-2026-27860 dovecot Corrigé dans: 1:2.4.1+dfsg1-6+deb13u4
Références
- advisory documentation.open-xchange.com
- advisory github.com
- advisory nvd.nist.gov