Threats affecting pkg:rpm/suse/dovecot24-backend-pgsql

Multiple security vulnerabilities affecting dovecot24 have been addressed in an update to version 2.4.4. These include issues such as a filter leak in lib-var-expand, IPC protection bypass via base64 input containing tabs, inefficient substring matching bypassing CPU time limits in Sieve, shared-spam of IMAP folders, and uncontrolled memory usage from excessive bracing in IMAP login. The update fixes these high-severity issues.

This security update for dovecot24 addresses multiple vulnerabilities including denial of service via invalid base64 authentication, potential file disclosure through symlink following during OOXML extraction, a panic in ManageSieve, SQL injection and LDAP query injection when auth_username_chars is empty, OTP driver replay attacks, timing attack on Doveadm credentials, and excessive resource consumption via malformed IMAP login and MIME parameters. These issues are fixed in version 2.4.3.