CVE-2019-3814

Severity: medium (CVSS 6.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-03-27 · updated 2026-06-17
Weakness: CWE-295

Description

It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users.

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 18.10
dovecot: from 1.1.0 before 2.2.36.1; from 2.3.0 before 2.3.4.1 — fixed in 2.2.36.1, 2.3.4.1
openSUSE Leap: 42.3

How to fix

Upgrade to a fixed version: dovecot 2.2.36.1, 2.3.4.1. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00067.html
https://access.redhat.com/errata/RHSA-2019:3467
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3814
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLI55NGRDTGMVOPYFCPPFNPA5VKYSSY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QHFZ5OWRIZGIWZJ5PTNVWWZNLLNH4XYS/
https://security.gentoo.org/glsa/201904-19
https://www.dovecot.org/list/dovecot/2019-February/114575.html
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00067.html
https://access.redhat.com/errata/RHSA-2019:3467
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3814
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLI55NGRDTGMVOPYFCPPFNPA5VKYSSY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QHFZ5OWRIZGIWZJ5PTNVWWZNLLNH4XYS/

Get alerted when CVE-2019-3814 or the next vulnerability affects your stack