CVE-2008-4870: dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions fo...

Security readout for executives and security teams

This is a legacy Dovecot configuration exposure issue. On RHEL 5 Dovecot 1.0.7, and possibly Fedora, dovecot.conf could be readable by all local users, exposing the ssl_key_password value. The main business risk is compromise of mail-server cryptographic secret material by someone who already has local system access. Exposure is most plausible on old Linux mail servers running the affected Dovecot package lineage, especially RHEL 5 systems and possibly Fedora. Modern supported distributions are less likely unless they retained the vulnerable packaging or permissions behavior. Treat as a targeted legacy-infrastructure risk. It is not described as remotely exploitable, but it can expose sensitive mail-server secrets where local users exist. Prioritize any internet-facing or shared mail hosts still running unsupported RHEL 5-era packages. Mitigation focus: Apply applicable vendor security updates, including Red Hat RHSA-2009:0205 where relevant.; Review Red Hat, Gentoo, and distribution guidance before changing package-managed configuration behavior.; Ensure dovecot.conf is not world-readable on affected systems..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.