https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz.sig <https://dovecot.org/releases/2.3/dovecot-2.3.2.tar.gz.sig> Binary packages in https://repo.dovecot.org/     * CVE-2019-3814: If imap/pop3/managesieve/submission client has       trusted certificate with missing username field       (ssl_cert_username_field), under some configurations Dovecot       mistakenly trusts the username provided via authentication instead       of failing.     * ssl_cert_username_field setting was ignored with external SMTP AUTH,       because none of the MTAs (Postfix, Exim) currently send the       cert_username field. This may have allowed users with trusted       certificate to specify any username in the authentication. This bug       didn't affect Dovecot's Submission service. --- Aki Tuomi Open-Xchange oy