CVE-2008-4870
Publication date 1 November 2008
Last updated 24 July 2024
Ubuntu priority
dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password parameter value.
Notes
jdstrand
marking as low because the default configuration doesn't set ssl_key_password
mdeslaur
file permissions can't be changed because of "deliver" Red Hat backported a new "!include_try" directive to the config file that allows including a second permission-protected config file (taken from 1.1.7) Debian says "by default this file doesnt containt sensitive information and administrator changing this should ensure on its own that the mode is secure" after discussion with kees and jdstrand, here's our plan: TODO: add a warning to the default conf file. on second thought, not worth risking a conf file prompt, so marking as ignored