CVE-2011-4318

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname…

published March 7, 2013

CVSS
—
EPSS
1%
Percentile
70.5
In the wild
Unconfirmed
What it is

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01321 · 70.5th percentile
Published
2013-03-07T01:00Z
EPSS history
Timeline
  • 07 MAR 01:00Z
    Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname…
    cvelistv5