Skip to content
Heist/ feed
UnratedFix available

DEBIAN-CVE-2026-0394

Type: advisorySource: OSV1 source record

When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal can happen if the domain component is directory partial. This allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains passwords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear valid users. Upgrade to fixed version, or use different authentication scheme that does not rely on paths. Alternatively you can also ensure that the per-domain passwd files are in some other location, such as /etc/dovecot/auth/%d. No publicly available exploits are known.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-0394

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-0394

dovecot

Source reference: /affected/0/package/name

Affected versions
1:2.3.19.1+dfsg1-2.1

Source reference: /affected/0/versions

1:2.3.19.1+dfsg1-2.1+deb12u1

Source reference: /affected/0/versions

Fixed versions
1:2.3.19.1+dfsg1-2.1+deb12u2

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

dovecot

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
1:2.4.1+dfsg1-1

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

dovecot

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
1:2.4.1+dfsg1-1

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:2.3.19.1+dfsg1-2.1+deb12u2"
          }
        ]
      }
    ],
    "package": {
      "name": "dovecot",
      "purl": "pkg:deb/debian/dovecot?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "1:2.3.19.1+dfsg1-2.1",
      "1:2.3.19.1+dfsg1-2.1+deb12u1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-0394.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:2.4.1+dfsg1-1"
          }
        ]
      }
    ],
    "package": {
      "name": "dovecot",
      "purl": "pkg:deb/debian/dovecot?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-0394.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:2.4.1+dfsg1-1"
          }
        ]
      }
    ],
    "package": {
      "name": "dovecot",
      "purl": "pkg:deb/debian/dovecot?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-0394.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#55382 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement