Unscored severity · published Mar 7, 2013
CVE-2011-4318
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Dovecot · Dovecot
2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +10 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4318
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4318
hg.dovecot.org
http://hg.dovecot.org/dovecot-2.0/rev/5e9eaf63a6b1
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0520.html
secunia.com
http://secunia.com/advisories/46886
Vendor Advisory
http://secunia.com/advisories/52311
www.dovecot.org
http://www.dovecot.org/list/dovecot-news/2011-November/000200.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2011/11/18/5
More from Dovecot
9.8
CVE-2019-11500
In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings
9.1
CVE-2026-27851
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped
8.8
CVE-2022-30550
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20
8.2
CVE-2026-24031
Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin
7.8
CVE-2019-7524
In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root