Re: CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole

Hello,

Cc'ing Apollon in hopes he might have some insight here.

When upgrading on Debian Stretch with the security fix packages all dovecot processes get killed and then restarted despite having "shutdown_clients = no" set.

My guess would be a flaw in the upgrade procedure and/or unit files doing a stop and start when the new imapd package is installed.

Can anybody think of a quick workaround or fix for this, as it's clearly not intended behavior (nor needed for this issue).

Thanks,

Christian

Christian Balzer Network/Systems Engineer
chibi@gol.com Rakuten Mobile Inc.