#1142468 Security update 1:2.4.1+dfsg1-6+deb13u6 makes GSSAPI authentication fail

Package:
dovecot-imapd
Source:
dovecot-imapd
Description:
secure POP3/IMAP server - IMAP daemon
Submitter:
Wouter Verhelst
Date:
2026-07-20 18:47:01 UTC
Severity:
normal
#1142468#5
Date:
2026-07-20 09:14:15 UTC
From:
To:
Hi,

After installing version 1:2.4.1+dfsg1-6+deb13u6 on my server, authentication starts failing like so:

wouter@pc220518:~$ mbsync -a
IMAP command 'AUTHENTICATE GSSAPI YIIC+AYJKoZ[...BASE64 data censored...]/z04t1yLI4jO7FJia0=' returned an error: [AUTHENTICATIONFAILED] Authentication failed.

The changelog of that version mentions:

* [366ef61] CVE-2026-33603: login-common: Only accept base64 in sasl

Which seems like it might be overly strict?

At any rate, downgrading to 1:2.4.1+dfsg1-6+deb13u5 resolves the issue.
#1142468#14
Date:
2026-07-20 18:45:14 UTC
From:
To:
Interesting. When I run gsasl's autopkgtest suite, which includes a
gssapi authentication test, against trixie's 1:2.4.1+dfsg1-6+deb13u6
packages, it is able to authenticate successfully.

The patch was cherry-picked from upstream and is in sid/forky as well as
the current upstream releases.  Which is not to say that it can't have
introduced a regression, of course...

I'll continue investigating.  I have not tested your configuration, nor
have I tested mbsync, so there's more to look at.

noah