[ubuntu/groovy-security] dovecot 1:2.3.11.3+dfsg1-2ubuntu0.2 (Accepted)

[Marc Deslauriers]

dovecot (1:2.3.11.3+dfsg1-2ubuntu0.2) groovy-security; urgency=medium

  * SECURITY UPDATE: incorrectly escapes kid and azp fields in JWT tokens
    - debian/patches/CVE-2021-29157.patch: improve escaping in
      src/lib-dict-extra/dict-fs.c, src/lib-oauth2/oauth2-jwt.c,
      src/lib-oauth2/test-oauth2-jwt.c.
    - CVE-2021-29157
  * SECURITY UPDATE: plaintext command injection before STARTTLS
    - debian/patches/CVE-2021-33515.patch: properly handle command queue in
      src/lib-smtp/smtp-server-cmd-starttls.c,
      src/lib-smtp/smtp-server-connection.c.
    - CVE-2021-33515

Date: 2021-06-16 18:02:16.502775+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/dovecot/1:2.3.11.3+dfsg1-2ubuntu0.2
-------------- next part --------------
Sorry, changesfile not available.