Opened 2 months ago

Closed 2 months ago

#23832 closed enhancement (fixed)

dovecot-2.4.5 (Security Update)

Reported by: Bruce Dubbs Owned by: SecurityAdvisory
Priority: normal Milestone: 98-Security
Component: BOOK Version: git
Severity: normal Keywords:
Cc:

Description

New point version.

Change History (4)

comment:1 by Bruce Dubbs, 2 months ago

Owner: changed from blfs-book to Bruce Dubbs
Status: new → assigned

comment:2 by Bruce Dubbs, 2 months ago

Summary: dovecot-2.4.5 → dovecot-2.4.5 (Security Update)

Dovecot version 2.4.5 was released on August 28, 2026, featuring important security fixes for CVEs discovered via automated code analysis tools, alongside several functional updates and repository modifications.

Key Updates & Fixes

  • Security Fixes: Includes patches for CVEs discovered by external researchers and automated analysis tools (such as CVE-2026-33605).
  • Index Format Change: The dovecot.index.thread index used by the IMAP THREAD command was updated to a new v2 format.
  • Authentication Changes: One-time password (OTP) mechanisms were removed in version 2.4.5.
  • Repository Changes: Support for Ubuntu 22.04 (Jammy) was dropped from repo.dovecot.org, while Ubuntu 26.04 (Resolute Raccoon) was added.

  • Privilege Drop: The indexer-worker service now forces dropped root privileges with updated default configurations.

comment:3 by Bruce Dubbs, 2 months ago

Milestone: 13.2 → 98-Security
Owner: changed from Bruce Dubbs to SecurityAdvisory
Status: assigned → new

Updated at commit ec6455ec2c. Leaving open for SA.

comment:4 by Bruce Dubbs, 2 months ago

Resolution: → fixed
Status: new → closed

Advisory sa-13.1-008 has been issued.

Note: See TracTickets for help on using tickets.