SUSE-SU-2025:21159-1: moderate: Security update for dovecot24
SLE-SECURITY-UPDATES
null at suse.de
Wed Dec 10 16:51:17 UTC 2025
# Security update for dovecot24
Announcement ID: SUSE-SU-2025:21159-1
Release Date: 2025-11-27T20:17:17Z
Rating: moderate
References:
* bsc#1252839
Cross-References:
* CVE-2025-30189
CVSS scores:
* CVE-2025-30189 ( SUSE ): 5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
* CVE-2025-30189 ( SUSE ): 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
* CVE-2025-30189 ( NVD ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products:
* SUSE Linux Enterprise Server 16.0
* SUSE Linux Enterprise Server for SAP Applications 16.0
An update that solves one vulnerability can now be installed.
## Description:
This update for dovecot24 fixes the following issues:
* Update dovecot to 2.4.2:
* CVE-2025-30189: Fixed users cached with same cache key when auth cache was
enabled (bsc#1252839)
* Changes
* auth: Remove proxy_always field.
* config: Change settings history parsing to use python3.
* doveadm: Print table formatter - Print empty values as "-".
* imapc: Propagate remote error codes properly.
* lda: Default mail_home=$HOME environment if not using userdb lookup
* lib-dcrypt: Salt for new version 2 keys has been increased to 16 bytes.
* lib-dregex: Add libpcre2 based regular expression support to Dovecot, if the library is missing, disable all regular expressions. This adds libpcre2-32 as build dependency.
* lib-oauth2: jwt - Allow nbf and iat to point 1 second into future.
* lib: Replace libicu with our own unicode library. Removes libicu as build dependency.
* login-common: If proxying fails due to remote having invalid SSL cert, don't reconnect.
* New features
* auth: Add ssl_client_cert_fp and ssl_client_cert_pubkey_fp fields
* config: Add support for $SET:filter/path/setting.
* config: Improve @group includes to work with overwriting their settings.
* doveadm kick: Add support for kicking multiple usernames
* doveadm mailbox status: Add support for deleted status item.
* imap, imap-client: Add experimental partial IMAP4rev2 support.
* imap: Implement support for UTF8=ACCEPT for APPEND
* lib-oauth2, oauth2: Add oauth2_token_expire_grace setting.
* lmtp: lmtp-client - Support command pipelining.
* login-common: Support local/remote blocks better.
* master: accept() unix/inet connections before creating child process to handle it. This reduces timeouts when child processes are slow to spawn themselves.
* Bug fixes
* SMTPUTF8 was accepted even when it wasn't enabled.
* auth, *-login: Direct logging with -L parameter was not working.
* auth: Crash occured when OAUTH token validation failed with oauth2_use_worker_with_mech=yes.
* auth: Invalid field handling crashes were fixed.
* auth: ldap - Potential crash could happen at deinit.
* auth: mech-gssapi - Server sending empty initial response would cause errors.
* auth: mech-winbind - GSS-SPNEGO mechanism was erroneously marked as
* not accepting NUL.
* config: Multiple issues with $SET handling has been fixed.
* configure: Building without LDAP didn't work.
* doveadm: If source user didn't exist, a crash would occur.
* imap, pop3, submission, imap-urlauth: USER environment usage was broken when running standalone.
* imap-hibernate: Statistics would get truncated on unhibernation.
* imap: "SEARCH MIMEPART FILENAME ENDS" command could have accessed memory outside allocated buffer, resulting in a crash.
* imapc: Fetching partial headers would cause other cached headers to be cached empty, breaking e.g. imap envelope responses when caching to disk.
* imapc: Shared namespace's INBOX mailbox was not always uppercased.
* imapc: imapc_features=guid-forced GUID generation was not working correctly.
* lda: USER environment was not accepted if -d hasn't been specified.
* lib-http: http-url - Significant path percent encoding through parse and create was not preserved. This is mainly important for Dovecot's Lua bindings for lib-http.
* lib-settings: Crash would occur when using %variables in SET_FILE type settings.
* lib-storage: Attachment flags were attempted to be added for readonly mailboxes with mail_attachment_flags=add-flags.
* lib-storage: Root directory for unusable shared namespaces was unnecessarily attempted to be created.
* lib: Crash would occur when config was reloaded and logging to syslog.
* login-common: Crash might have occured when login proxy was destroyed.
* sqlite: The sqlite_journal_mode=wal setting didn't actually do anything.
* Many other bugs have been fixed.
* Update pigeonhole to 2.4.2
* Changes
* lib-sieve: Use new regular expression library in core.
* managesieve: Add default service_extra_groups=$SET:default_internal_group.
* New features
* lib-sieve: Add support for "extlists" extension.
* lib-sieve: regex - Allow unicode comparator.
* Bug fixes
* lib-sieve-tool: sieve-tool - All sieve_script settings were overriden.
* lib-sieve: storage: dict: sieve_script_dict filter was missing from settings.
* sieve-ldap-storage: Fix compile without LDAP.
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server 16.0
zypper in -t patch SUSE-SLES-16.0-79=1
* SUSE Linux Enterprise Server for SAP Applications 16.0
zypper in -t patch SUSE-SLES-16.0-79=1
## Package List:
* SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64)
* dovecot24-devel-2.4.2-160000.1.1
* dovecot24-backend-sqlite-2.4.2-160000.1.1
* dovecot24-backend-mysql-2.4.2-160000.1.1
* dovecot24-fts-solr-2.4.2-160000.1.1
* dovecot24-backend-pgsql-2.4.2-160000.1.1
* dovecot24-backend-pgsql-debuginfo-2.4.2-160000.1.1
* dovecot24-fts-debuginfo-2.4.2-160000.1.1
* dovecot24-backend-sqlite-debuginfo-2.4.2-160000.1.1
* dovecot24-fts-2.4.2-160000.1.1
* dovecot24-fts-solr-debuginfo-2.4.2-160000.1.1
* dovecot24-debuginfo-2.4.2-160000.1.1
* dovecot24-backend-mysql-debuginfo-2.4.2-160000.1.1
* dovecot24-2.4.2-160000.1.1
* dovecot24-debugsource-2.4.2-160000.1.1
* SUSE Linux Enterprise Server for SAP Applications 16.0 (ppc64le x86_64)
* dovecot24-devel-2.4.2-160000.1.1
* dovecot24-backend-sqlite-2.4.2-160000.1.1
* dovecot24-backend-mysql-2.4.2-160000.1.1
* dovecot24-fts-solr-2.4.2-160000.1.1
* dovecot24-backend-pgsql-2.4.2-160000.1.1
* dovecot24-backend-pgsql-debuginfo-2.4.2-160000.1.1
* dovecot24-fts-debuginfo-2.4.2-160000.1.1
* dovecot24-backend-sqlite-debuginfo-2.4.2-160000.1.1
* dovecot24-fts-2.4.2-160000.1.1
* dovecot24-fts-solr-debuginfo-2.4.2-160000.1.1
* dovecot24-debuginfo-2.4.2-160000.1.1
* dovecot24-backend-mysql-debuginfo-2.4.2-160000.1.1
* dovecot24-2.4.2-160000.1.1
* dovecot24-debugsource-2.4.2-160000.1.1
## References:
* https://www.suse.com/security/cve/CVE-2025-30189.html
* https://bugzilla.suse.com/show_bug.cgi?id=1252839
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20251210/e94ff302/attachment.htm>
More information about the sle-security-updates
mailing list