CVE-2019-3814: canonical ubuntu_linux Improper Certificate Validation
CVSS: 7.7v3.0HighModified
AliasesALPINE-CVE-2019-3814MGASA-2019-0072SUSE-SU-2019:0414-1RHSA-2019:3467UBUNTU-CVE-2019-3814USN-3881-1DEBIAN-CVE-2019-3814DLA-1667-1DSA-4385-1
Published 27-03-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-3814 is a high (CVSS 7.7) Improper Certificate Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 2.42% chance of exploitation in the next 30 days, higher than 83.9% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.7/10
010
High · v3.0 (CVE.org)EPSS score
2.42%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 27-03-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users.
CVSS metrics
7 scores · 6 sources · 2 versionsHigh 7.7Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:NSources6 sources · 6.8–7.7
- OSV · AlpineEcosystem advisory · calculated6.8MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NDiffers
- OSV · Red hatEcosystem advisory · calculated7.7HighCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.7HighCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.8MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NDiffers
- NVDNIST6.8MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NDiffers
Medium 4.9Preferred score · NVD (NIST)
AV:N/AC:M/Au:S/C:P/I:P/A:NSourcesSingle source
EPSS trend
Probability
2.42%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
0.00 pp
From 2.42% on 20-09-2026
20-09-202620-10-2026
EPSS score2.42%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (dovecot.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat10 products
- dovecot< 1:2.2.36-10.el8
- dovecot-debuginfo< 1:2.2.36-10.el8
- dovecot-debugsource< 1:2.2.36-10.el8
- dovecot-devel< 1:2.2.36-10.el8
- dovecot-mysql< 1:2.2.36-10.el8
Alpine1 product
- dovecot≥ 1.1.0, < 2.3.4.1-r0 | ≥ 1.1.0, < 2.2.36.1-r0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 18.10
Debian1 product
- dovecot< 1:2.3.4.1-1 | < 1:2.2.27-3+deb9u3 | < 1:2.2.13-12~deb8u5
Dovecot1 product
- dovecotEOL2.2.36.1 | 2.3.4.1 | ≥ 1.1.0, < 2.2.36.1 | ≥ 2.3.0, < 2.3.4.1
Mageia1 product
- dovecot< 2.2.36.1-1.mga6
Opensuse1 product
- leapEOL42.3
Suse1 product
- dovecot23&distro=SUSE Linux Enterprise Module for Server Applications 15< 2.3.3-4.7.4
Ubuntu1 product
- dovecot< 1:2.2.9-1ubuntu2.5 | < 1:2.2.22-1ubuntu2.9 | < 1:2.2.33.2-1ubuntu4.2
9 vendors · 18 products
References
30 links- www.dovecot.org/list/dovecot/2019-February/114575.htmlX Refsource MISCARTICLEExploitMailing ListVendor Advisory
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3814X Refsource CONFIRMIssue TrackingRelease NotesThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00067.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
