Edit: readers should skip to the announcement ~~@muhlemmer
As of
https://dovecot.org/pipermail/dovecot-news/2019-August/000418.html
there seems do be an security issue in dovecot-imap. Not sure if mailu is affected since there is the front-container. Somebody here who have more information? Since this should be exploitable pre-auth too this might be important.
sbias
All 9 comments
Just read about it, I will try to confirm if Mailu is directly vulnerable or not really soon. Then we might want to patch and backport at least to 1.6 and 1.7, the schedule depending on exploitability.
kaiyou
on 28 Aug 2019
It does not seem like Mailu is easily exploitable thanks to the front nginx. There are probably exploitation cases however, once authenticated. I will now see that we update dovecot asap.
kaiyou
on 28 Aug 2019
Dovecot is now updated in master, 1.7 should get updated with today's backport of Rainloop update. We will close then.
kaiyou
on 5 Sep 2019
It seems to be upgraded in current image - can this ticket get closed?
bash-5.0# dovecot --version
2.3.7.2 (3c910f64b)
sbias
on 13 Sep 2019
Needs to be checked for 1.6 as well, though it should be OK.
kaiyou
on 14 Sep 2019
:heavy_check_mark:
$ docker run --rm mailu/dovecot:1.6 dovecot --version
Unable to find image 'mailu/dovecot:1.6' locally
1.6: Pulling from mailu/dovecot
c87736221ed0: Pull complete
a1c9b6fc100f: Pull complete
d48a25f5d439: Pull complete
debbe44d4442: Pull complete
ad6083978593: Pull complete
744f46e964cb: Pull complete
fc33eef7d816: Pull complete
Digest: sha256:68b0da78dd581a55ae9be46fdcd2c8911f1c5b84e089a3fce89e9361e1f1d2ec
Status: Downloaded newer image for mailu/dovecot:1.6
2.3.7.2 (3c910f64b)
muhlemmer
on 14 Sep 2019
Announcement:
All users are advised to update to the latest images their versions. Currently Mailu versions 1.6, 1.7 and master are still supported and contain the latest version of Dovecot.
No need for configuration changes are needed for this update. Just:
docker-compose pull
docker-compose up -d
Verify the current running version of Dovecot:
docker-compose exec imap dovecot --version
Should give 2.3.7.2 or higher.
muhlemmer
on 14 Sep 2019
Pinned for announcement. Can be closed after a reasonable time for users to update.
muhlemmer
on 14 Sep 2019
Closing now.
kaiyou
on 7 Feb 2020
Related issues
styxlab
路
4Comments
kaiyou
路
4Comments
v1ru535
路
4Comments
elektro-wolle
路
3Comments
gizocz
路
4Comments
Most helpful comment
It does not seem like Mailu is easily exploitable thanks to the front nginx. There are probably exploitation cases however, once authenticated. I will now see that we update dovecot asap.