Package: dovecot-common Version: 1:1.2.15-7 Severity: grave Tags: security squeeze upstream Justification: user security hole
Hi there, I guess everybody knows by now that CVE-2014-3566 changes the status of SSLv3 from mostly-obsolete to mostly-broken. Unfortunately dovecot previous to 2.1 doesn't distinguish between security protocols and cyphers. Therefore simply disabling SSLv3 in dovecot.conf like this ssl_cipher_list = ALL:!LOW:!SSLv2:!SSLv3 will apparently disable all cyphers. There is a simple one line patch available for dovecot 2.0. Maybe a similar way exists for 1.2. best regards -henrik -- System Information: Debian Release: 6.0.10 APT prefers squeeze-lts APT policy: (500, 'squeeze-lts'), (500, 'oldstable') Architecture: i386 (i686) Kernel: Linux 2.6.32-5-686 (SMP w/2 CPU cores) Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968) Shell: /bin/sh linked to /bin/bash Versions of packages dovecot-common depends on: ii adduser 3.112+nmu2 add and remove users and groups ii libbz2-1.0 1.0.5-6+squeeze1 high-quality block-sorting file co ii libc6 2.11.3-4+deb6u1 Embedded GNU C Library: Shared lib ii libcomerr2 1.41.12-4stable1 common error description library ii libdb4.8 4.8.30-2 Berkeley v4.8 Database Libraries [ ii libgssapi-krb5-2 1.8.3+dfsg-4squeeze8 MIT Kerberos runtime libraries - k ii libk5crypto3 1.8.3+dfsg-4squeeze8 MIT Kerberos runtime libraries - C ii libkrb5-3 1.8.3+dfsg-4squeeze8 MIT Kerberos runtime libraries ii libldap-2.4-2 2.4.23-7.3 OpenLDAP libraries ii libmysqlclient16 5.1.73-1 MySQL database client library ii libpam-runtime 1.1.1-6.1+squeeze1 Runtime support for the PAM librar ii libpam0g 1.1.1-6.1+squeeze1 Pluggable Authentication Modules l ii libpq5 8.4.22-0+deb6u1 PostgreSQL C client library ii libsqlite3-0 3.7.3-1 SQLite 3 shared library ii libssl0.9.8 0.9.8o-4squeeze17 SSL shared libraries ii openssl 0.9.8o-4squeeze17 Secure Socket Layer (SSL) binary a ii ucf 3.0025+nmu1 Update Configuration File: preserv ii zlib1g 1:1.2.3.4.dfsg-3 compression library - runtime dovecot-common recommends no packages. Versions of packages dovecot-common suggests: pn ntp <none> (no description available) -- no debconf information -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
