<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    <p>
    </p>
    <div class="moz-text-plain" wrap="true" style="font-family:
      -moz-fixed; font-size: 12px;" lang="x-unicode">
      <pre class="moz-quote-pre" wrap=""><a class="moz-txt-link-freetext" href="https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz">https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz</a>
<a class="moz-txt-link-freetext" href="https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz.sig">https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz.sig</a>
<a class="moz-txt-link-rfc2396E" href="https://dovecot.org/releases/2.3/dovecot-2.3.2.tar.gz.sig"><https://dovecot.org/releases/2.3/dovecot-2.3.2.tar.gz.sig></a>
Binary packages in <a class="moz-txt-link-freetext" href="https://repo.dovecot.org/">https://repo.dovecot.org/</a>

    * CVE-2019-3814: If imap/pop3/managesieve/submission client has
      trusted certificate with missing username field
      (ssl_cert_username_field), under some configurations Dovecot
      mistakenly trusts the username provided via authentication instead
      of failing.
    * ssl_cert_username_field setting was ignored with external SMTP AUTH,
      because none of the MTAs (Postfix, Exim) currently send the
      cert_username field. This may have allowed users with trusted
      certificate to specify any username in the authentication. This bug
      didn't affect Dovecot's Submission service.


---

Aki Tuomi
Open-Xchange oy

</pre>
    </div>
  </body>
</html>