CVE-2011-4318
- State
- Published
- Severity
- Not scored
- Published
- Mar 7, 2013
- Updated
- Aug 7, 2024
- Reserved
- Nov 4, 2011
Description
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 46886third-party-advisory
- RHSA-2013:0520vendor-advisory
- https://bugs.gentoo.org/show_bug.cgi?id=390887
- https://bugzilla.redhat.com/show_bug.cgi?id=754980
- 52311third-party-advisory
- http://hg.dovecot.org/dovecot-2.0/rev/5e9eaf63a6b1
- [dovecot-news] 20111117 v2.0.16 releasedmailing-list
- [oss-security] 20111118 Re: CVE Request -- Dovecot -- Validate certificate's CN against requested remote server hostname when proxyingmailing-list
- [oss-security] 20111118 Re: CVE Request -- Dovecot -- Validate certificate's CN against requested remote server hostname when proxyingmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.