DLA-4873-1 dovecot - security update
概要
CVE-2026-42394 Pigeonhole's file storage follows any symlink encountered while resolving a script path, including symlinks in personal (user-writable) storage whose target lay outside the storage directory, thereby allowing arbitrary file disclosure via symlink traversal. Symlinks escaping personal...
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2026-42394 dovecot 修正版: 1:2.3.19.1+dfsg1-2.1+deb12u7
- Ubuntu UBUNTU-CVE-2026-42394 dovecot
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
CVE-2026-42394 Pigeonhole's file storage follows any symlink encountered while resolving a script path, including symlinks in personal (user-writable) storage whose target lay outside the storage directory, thereby allowing arbitrary file disclosure via symlink traversal. Symlinks escaping personal storage directory are no longer followed.
(Debian LTS Security Advisories: DLA-4873-1 dovecot - security update)
出典: Debian LTS Security Advisories NVD
参照URL
- DEBIAN-DLA DLA-4873-1 dovecot - security update