<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>
</p>
<div class="moz-text-plain" wrap="true" style="font-family:
-moz-fixed; font-size: 12px;" lang="x-unicode">
<pre class="moz-quote-pre" wrap=""><a class="moz-txt-link-freetext" href="https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz">https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz</a>
<a class="moz-txt-link-freetext" href="https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz.sig">https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz.sig</a>
<a class="moz-txt-link-rfc2396E" href="https://dovecot.org/releases/2.3/dovecot-2.3.2.tar.gz.sig"><https://dovecot.org/releases/2.3/dovecot-2.3.2.tar.gz.sig></a>
Binary packages in <a class="moz-txt-link-freetext" href="https://repo.dovecot.org/">https://repo.dovecot.org/</a>
* CVE-2019-3814: If imap/pop3/managesieve/submission client has
trusted certificate with missing username field
(ssl_cert_username_field), under some configurations Dovecot
mistakenly trusts the username provided via authentication instead
of failing.
* ssl_cert_username_field setting was ignored with external SMTP AUTH,
because none of the MTAs (Postfix, Exim) currently send the
cert_username field. This may have allowed users with trusted
certificate to specify any username in the authentication. This bug
didn't affect Dovecot's Submission service.
---
Aki Tuomi
Open-Xchange oy
</pre>
</div>
</body>
</html>