It was found that Berkeley DB reads the DBCONFIG configuration file from the current working directory by default. This happens when calling dbcreate() with dbenv=NULL; or using the dbmopen() function.
References:
http://seclists.org/oss-sec/2017/q2/452 http://www.postfix.org/announcements/postfix-3.2.2.html
Proposed patch:
http://seclists.org/oss-sec/2017/q2/475