Package: dovecot-imapd
Version: 1:2.4.1+dfsg1-6+deb13u6
Severity: important
Tags: security
X-Debbugs-Cc: [email protected], Debian Security Team
<[email protected]>
Hi,
After installing version 1:2.4.1+dfsg1-6+deb13u6 on my server, authentication
starts failing like so:
wouter@pc220518:~$ mbsync -a
IMAP command 'AUTHENTICATE GSSAPI YIIC+AYJKoZ[...BASE64 data
censored...]/z04t1yLI4jO7FJia0=' returned an error: [AUTHENTICATIONFAILED]
Authentication failed.
The changelog of that version mentions:
* [366ef61] CVE-2026-33603: login-common: Only accept base64 in sasl
Which seems like it might be overly strict?
At any rate, downgrading to 1:2.4.1+dfsg1-6+deb13u5 resolves the issue.
-- Package-specific info:
dovecot configuration
---------------------
# 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf
# Pigeonhole version 2.4.1-4 (0a86619f)
# OS: Linux 6.12.48+deb13-amd64 x86_64 Debian 13.6 zfs
# Hostname: lounge.grep.be
# 4 default setting changes since version 2.4.0
dovecot_config_version = 2.4.0
auth_krb5_keytab = /etc/dovecot/krb5.keytab
auth_mechanisms = plain gssapi
dovecot_storage_version = 2.4.0
fts_autoindex = yes
fts_autoindex_max_recent_msgs = 999
fts_search_add_missing = yes
mail_driver = maildir
mail_home = /mailstore/%{user|username}
mail_inbox_path = /mailstore/%{user|username}/.
mail_path = /mailstore/%{user|username}
mail_privileged_group = mail
protocols {
imap = yes
}
passdb pam {
}
userdb passwd {
}
namespace inbox {
inbox = yes
mailbox Drafts {
special_use = "\\Drafts"
}
mailbox Junk {
special_use = "\\Junk"
}
mailbox Trash {
special_use = "\\Trash"
}
mailbox Sent {
special_use = "\\Sent"
}
mailbox "Sent Messages" {
special_use = "\\Sent"
}
}
service imap-login {
inet_listener imap {
}
inet_listener imaps {
}
}
service pop3-login {
inet_listener pop3 {
}
inet_listener pop3s {
}
}
service submission-login {
inet_listener submission {
}
inet_listener submissions {
}
}
service lmtp {
unix_listener lmtp {
}
}
service imap {
}
service pop3 {
}
service submission {
}
service auth {
unix_listener auth-userdb {
}
}
service auth-worker {
}
service dict {
unix_listener dict {
}
}
ssl_server {
cert_file = /etc/letsencrypt/live/smtp.grep.be/fullchain.pem
key_file = /etc/letsencrypt/live/smtp.grep.be/privkey.pem
}
protocol imap {
mail_max_userip_connections = 20
}
-- System Information:
Debian Release: 13.6
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.48+deb13-amd64 (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE,
TAINT_UNSIGNED_MODULE
Locale: LANG=nl_BE.UTF-8, LC_CTYPE=nl_BE.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages dovecot-imapd depends on:
ii dovecot-core 1:2.4.1+dfsg1-6+deb13u5
ii libbz2-1.0 1.0.8-6
ii libc6 2.41-12+deb13u3
ii liblz4-1 1.10.0-4
ii libzstd1 1.5.7+dfsg-1
ii ucf 3.0052
ii zlib1g 1:1.3.dfsg+really1.3.1-1+b1
dovecot-imapd recommends no packages.
Versions of packages dovecot-imapd suggests:
pn ufw <none>
Versions of packages dovecot-imapd is related to:
ii dovecot-core [dovecot-common] 1:2.4.1+dfsg1-6+deb13u5
pn dovecot-dev <none>
ii dovecot-gssapi 1:2.4.1+dfsg1-6+deb13u5
ii dovecot-imapd 1:2.4.1+dfsg1-6+deb13u5
pn dovecot-ldap <none>
pn dovecot-lmtpd <none>
pn dovecot-managesieved <none>
pn dovecot-mysql <none>
pn dovecot-pgsql <none>
pn dovecot-pop3d <none>
ii dovecot-sieve 1:2.4.1+dfsg1-6+deb13u5
pn dovecot-sqlite <none>
-- no debconf information
