[CLSA-2026:1785836865] Fix CVE(s): CVE-2026-27858
Type:
security
Severity:
Important
Release date:
2026-08-04 09:48:01 UTC
Description:
* SECURITY UPDATE: managesieve-login pre-auth excessive memory usage DoS via oversized AUTHENTICATE initial response (ELSCVE-158963) - debian/patches/CVE-2026-27858.patch: verify the AUTHENTICATE initial response size is not too large before allocating in pigeonhole/src/managesieve-login/client-authenticate.c. Backport of upstream pigeonhole commit 54f645225a8a: the five added lines are byte-identical to upstream, while the hunk context is this tree's pre-cc1b8988 (unreformatted) layout, which is why the blob index differs from upstream's. - CVE-2026-27858
CVEs fixed:
Updated packages:
  • dovecot-auth-lua_2.3.7.2-1ubuntu3.7+tuxcare.els3_amd64.deb
    sha:acd050bd7c5c60028ac0df455457d67a4666c3e3
  • dovecot-core_2.3.7.2-1ubuntu3.7+tuxcare.els3_amd64.deb
    sha:6724558667dfb9f246b2a968cd495757664fb448
  • dovecot-dev_2.3.7.2-1ubuntu3.7+tuxcare.els3_amd64.deb
    sha:d7a978554b7b82dc4dfb6031088d2c740f541518
  • dovecot-gssapi_2.3.7.2-1ubuntu3.7+tuxcare.els3_amd64.deb
    sha:26701b968ebb18b70b201268e7030106cf3671e7
  • dovecot-imapd_2.3.7.2-1ubuntu3.7+tuxcare.els3_amd64.deb
    sha:c7d19a06b4bab538e44f29826adb7830e4fb86ab
  • dovecot-ldap_2.3.7.2-1ubuntu3.7+tuxcare.els3_amd64.deb
    sha:a396ca89a041b774d251364d2b9dd3043c3ab156
  • dovecot-lmtpd_2.3.7.2-1ubuntu3.7+tuxcare.els3_amd64.deb
    sha:b78f1dadfe0e9f1acfbb0c090c5e62db65c5283f
  • dovecot-lucene_2.3.7.2-1ubuntu3.7+tuxcare.els3_amd64.deb
    sha:177fd93e5fdd03401252647b0a20126f2924c8c1
  • dovecot-managesieved_2.3.7.2-1ubuntu3.7+tuxcare.els3_amd64.deb
    sha:800f84f8009d257f866e1ac05ca939a211338ba8
  • dovecot-mysql_2.3.7.2-1ubuntu3.7+tuxcare.els3_amd64.deb
    sha:b1512aa474d1673caaa9407615f0d242724db677
  • dovecot-pgsql_2.3.7.2-1ubuntu3.7+tuxcare.els3_amd64.deb
    sha:85c92841c0303b4b044d618021345719c281a37c
  • dovecot-pop3d_2.3.7.2-1ubuntu3.7+tuxcare.els3_amd64.deb
    sha:962026baed445abeef860dd02cc57820fcfb52cc
  • dovecot-sieve_2.3.7.2-1ubuntu3.7+tuxcare.els3_amd64.deb
    sha:b63fdf24f7f05cf967d61fce4a086527293d4cfd
  • dovecot-solr_2.3.7.2-1ubuntu3.7+tuxcare.els3_amd64.deb
    sha:089a7ae57211f47238860df12d75e0568895ccd9
  • dovecot-sqlite_2.3.7.2-1ubuntu3.7+tuxcare.els3_amd64.deb
    sha:5a1aaf8b08f6a09714a54673cca791e72f944b2a
  • dovecot-submissiond_2.3.7.2-1ubuntu3.7+tuxcare.els3_amd64.deb
    sha:3f9a44bc06abb9c44bc22766e549d1d27226d7e6
  • mail-stack-delivery_2.3.7.2-1ubuntu3.7+tuxcare.els3_all.deb
    sha:3468f25cc54d2042a5cbdf2f6a9b995b08ebd610
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.