Search criteria
169 vulnerabilities found for Dovecot by Dovecot
CERTFR-2025-AVI-0962
Vulnerability from certfr_avis - Published: 2025-11-04 - Updated: 2025-11-04
Une vulnérabilité a été découverte dans Dovecot. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Dovecot Pro core versions 2.4.x ant\u00e9rieures \u00e0 2.4.2",
"product": {
"name": "Dovecot",
"vendor": {
"name": "Dovecot",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-30189",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30189"
}
],
"initial_release_date": "2025-11-04T00:00:00",
"last_revision_date": "2025-11-04T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0962",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-11-04T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Dovecot. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Vuln\u00e9rabilit\u00e9 dans Dovecot",
"vendor_advisories": [
{
"published_at": "2025-10-29",
"title": "Bulletin de s\u00e9curit\u00e9 Dovecot oxdc-adv-2025-0001",
"url": "https://documentation.open-xchange.com/dovecot/security/advisories/html/2025/oxdc-adv-2025-0001.html"
}
]
}
CERTFR-2025-AVI-0942
Vulnerability from certfr_avis - Published: 2025-10-31 - Updated: 2025-10-31
Une vulnérabilité a été découverte dans Dovecot. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Dovecot versions 2.4.x ant\u00e9rieures \u00e0 2.4.2",
"product": {
"name": "Dovecot",
"vendor": {
"name": "Dovecot",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-30189",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30189"
}
],
"initial_release_date": "2025-10-31T00:00:00",
"last_revision_date": "2025-10-31T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0942",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-10-31T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Dovecot. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Vuln\u00e9rabilit\u00e9 dans Dovecot",
"vendor_advisories": [
{
"published_at": "2025-10-29",
"title": "Bulletin de s\u00e9curit\u00e9 Dovecot G3K5HMBKW6XOYNBXYV5GUM2GR6WPUD4M",
"url": "https://dovecot.org/mailman3/archives/list/dovecot-news@dovecot.org/thread/G3K5HMBKW6XOYNBXYV5GUM2GR6WPUD4M/"
}
]
}
VAR-201105-0095
Vulnerability from variot - Updated: 2024-07-23 19:37lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' characters in header names, which allows remote attackers to cause a denial of service (daemon crash or mailbox corruption) via a crafted e-mail message. Dovecot is an open source IMAP and POP3 server for Linux/UNIX-like systems. Dovecot is prone to a denial-of-service vulnerability because it fails to properly parse message headers. A remote attacker can exploit this issue to crash the affected application, denying service to legitimate users. Dovecot versions prior to 1.2.17 and 2.0.13 are vulnerable. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
===================================================================== Red Hat Security Advisory
Synopsis: Moderate: dovecot security update Advisory ID: RHSA-2011:1187-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-1187.html Issue date: 2011-08-18 CVE Names: CVE-2011-1929 =====================================================================
- Summary:
Updated dovecot packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
- Relevant releases/architectures:
RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64
- (CVE-2011-1929)
Users of dovecot are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, the dovecot service will be restarted automatically.
- Solution:
Before applying this update, make sure all previously-released errata relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259
- Bugs fixed (http://bugzilla.redhat.com/):
706286 - CVE-2011-1929 dovecot: potential crash when parsing header names that contain NUL characters
- Package List:
Red Hat Enterprise Linux AS version 4:
Source: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/dovecot-0.99.11-10.EL4.src.rpm
i386: dovecot-0.99.11-10.EL4.i386.rpm dovecot-debuginfo-0.99.11-10.EL4.i386.rpm
ia64: dovecot-0.99.11-10.EL4.ia64.rpm dovecot-debuginfo-0.99.11-10.EL4.ia64.rpm
ppc: dovecot-0.99.11-10.EL4.ppc.rpm dovecot-debuginfo-0.99.11-10.EL4.ppc.rpm
s390: dovecot-0.99.11-10.EL4.s390.rpm dovecot-debuginfo-0.99.11-10.EL4.s390.rpm
s390x: dovecot-0.99.11-10.EL4.s390x.rpm dovecot-debuginfo-0.99.11-10.EL4.s390x.rpm
x86_64: dovecot-0.99.11-10.EL4.x86_64.rpm dovecot-debuginfo-0.99.11-10.EL4.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
Source: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/dovecot-0.99.11-10.EL4.src.rpm
i386: dovecot-0.99.11-10.EL4.i386.rpm dovecot-debuginfo-0.99.11-10.EL4.i386.rpm
x86_64: dovecot-0.99.11-10.EL4.x86_64.rpm dovecot-debuginfo-0.99.11-10.EL4.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
Source: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/dovecot-0.99.11-10.EL4.src.rpm
i386: dovecot-0.99.11-10.EL4.i386.rpm dovecot-debuginfo-0.99.11-10.EL4.i386.rpm
ia64: dovecot-0.99.11-10.EL4.ia64.rpm dovecot-debuginfo-0.99.11-10.EL4.ia64.rpm
x86_64: dovecot-0.99.11-10.EL4.x86_64.rpm dovecot-debuginfo-0.99.11-10.EL4.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
Source: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/dovecot-0.99.11-10.EL4.src.rpm
i386: dovecot-0.99.11-10.EL4.i386.rpm dovecot-debuginfo-0.99.11-10.EL4.i386.rpm
ia64: dovecot-0.99.11-10.EL4.ia64.rpm dovecot-debuginfo-0.99.11-10.EL4.ia64.rpm
x86_64: dovecot-0.99.11-10.EL4.x86_64.rpm dovecot-debuginfo-0.99.11-10.EL4.x86_64.rpm
RHEL Desktop Workstation (v. 5 client):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/dovecot-1.0.7-7.el5_7.1.src.rpm
i386: dovecot-1.0.7-7.el5_7.1.i386.rpm dovecot-debuginfo-1.0.7-7.el5_7.1.i386.rpm
x86_64: dovecot-1.0.7-7.el5_7.1.x86_64.rpm dovecot-debuginfo-1.0.7-7.el5_7.1.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/dovecot-1.0.7-7.el5_7.1.src.rpm
i386: dovecot-1.0.7-7.el5_7.1.i386.rpm dovecot-debuginfo-1.0.7-7.el5_7.1.i386.rpm
ia64: dovecot-1.0.7-7.el5_7.1.ia64.rpm dovecot-debuginfo-1.0.7-7.el5_7.1.ia64.rpm
ppc: dovecot-1.0.7-7.el5_7.1.ppc.rpm dovecot-debuginfo-1.0.7-7.el5_7.1.ppc.rpm
s390x: dovecot-1.0.7-7.el5_7.1.s390x.rpm dovecot-debuginfo-1.0.7-7.el5_7.1.s390x.rpm
x86_64: dovecot-1.0.7-7.el5_7.1.x86_64.rpm dovecot-debuginfo-1.0.7-7.el5_7.1.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/dovecot-2.0.9-2.el6_1.1.src.rpm
i386: dovecot-2.0.9-2.el6_1.1.i686.rpm dovecot-debuginfo-2.0.9-2.el6_1.1.i686.rpm dovecot-mysql-2.0.9-2.el6_1.1.i686.rpm dovecot-pgsql-2.0.9-2.el6_1.1.i686.rpm dovecot-pigeonhole-2.0.9-2.el6_1.1.i686.rpm
ppc64: dovecot-2.0.9-2.el6_1.1.ppc.rpm dovecot-2.0.9-2.el6_1.1.ppc64.rpm dovecot-debuginfo-2.0.9-2.el6_1.1.ppc.rpm dovecot-debuginfo-2.0.9-2.el6_1.1.ppc64.rpm dovecot-mysql-2.0.9-2.el6_1.1.ppc64.rpm dovecot-pgsql-2.0.9-2.el6_1.1.ppc64.rpm dovecot-pigeonhole-2.0.9-2.el6_1.1.ppc64.rpm
s390x: dovecot-2.0.9-2.el6_1.1.s390.rpm dovecot-2.0.9-2.el6_1.1.s390x.rpm dovecot-debuginfo-2.0.9-2.el6_1.1.s390.rpm dovecot-debuginfo-2.0.9-2.el6_1.1.s390x.rpm dovecot-mysql-2.0.9-2.el6_1.1.s390x.rpm dovecot-pgsql-2.0.9-2.el6_1.1.s390x.rpm dovecot-pigeonhole-2.0.9-2.el6_1.1.s390x.rpm
x86_64: dovecot-2.0.9-2.el6_1.1.i686.rpm dovecot-2.0.9-2.el6_1.1.x86_64.rpm dovecot-debuginfo-2.0.9-2.el6_1.1.i686.rpm dovecot-debuginfo-2.0.9-2.el6_1.1.x86_64.rpm dovecot-mysql-2.0.9-2.el6_1.1.x86_64.rpm dovecot-pgsql-2.0.9-2.el6_1.1.x86_64.rpm dovecot-pigeonhole-2.0.9-2.el6_1.1.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/dovecot-2.0.9-2.el6_1.1.src.rpm
i386: dovecot-debuginfo-2.0.9-2.el6_1.1.i686.rpm dovecot-devel-2.0.9-2.el6_1.1.i686.rpm
ppc64: dovecot-debuginfo-2.0.9-2.el6_1.1.ppc64.rpm dovecot-devel-2.0.9-2.el6_1.1.ppc64.rpm
s390x: dovecot-debuginfo-2.0.9-2.el6_1.1.s390x.rpm dovecot-devel-2.0.9-2.el6_1.1.s390x.rpm
x86_64: dovecot-debuginfo-2.0.9-2.el6_1.1.x86_64.rpm dovecot-devel-2.0.9-2.el6_1.1.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/dovecot-2.0.9-2.el6_1.1.src.rpm
i386: dovecot-2.0.9-2.el6_1.1.i686.rpm dovecot-debuginfo-2.0.9-2.el6_1.1.i686.rpm dovecot-mysql-2.0.9-2.el6_1.1.i686.rpm dovecot-pgsql-2.0.9-2.el6_1.1.i686.rpm dovecot-pigeonhole-2.0.9-2.el6_1.1.i686.rpm
x86_64: dovecot-2.0.9-2.el6_1.1.i686.rpm dovecot-2.0.9-2.el6_1.1.x86_64.rpm dovecot-debuginfo-2.0.9-2.el6_1.1.i686.rpm dovecot-debuginfo-2.0.9-2.el6_1.1.x86_64.rpm dovecot-mysql-2.0.9-2.el6_1.1.x86_64.rpm dovecot-pgsql-2.0.9-2.el6_1.1.x86_64.rpm dovecot-pigeonhole-2.0.9-2.el6_1.1.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/dovecot-2.0.9-2.el6_1.1.src.rpm
i386: dovecot-debuginfo-2.0.9-2.el6_1.1.i686.rpm dovecot-devel-2.0.9-2.el6_1.1.i686.rpm
x86_64: dovecot-debuginfo-2.0.9-2.el6_1.1.x86_64.rpm dovecot-devel-2.0.9-2.el6_1.1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package
- References:
https://www.redhat.com/security/data/cve/CVE-2011-1929.html https://access.redhat.com/security/updates/classification/#moderate
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2011 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFOTW29XlSAg2UNWIIRAr8LAKCu85vT3BXBKZ1SRebWK7B9nG6OFQCfYR3k P3AdaDf2BpXnEhk2OL5DTpo= =eG31 -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201110-04
http://security.gentoo.org/
Severity: High Title: Dovecot: Multiple vulnerabilities Date: October 10, 2011 Bugs: #286844, #293954, #314533, #368653 ID: 201110-04
Synopsis
Multiple vulnerabilities were found in Dovecot, the worst of which allowing for remote execution of arbitrary code.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-mail/dovecot < 2.0.13 *>= 1.2.17 >= 2.0.13
Description
Multiple vulnerabilities have been discovered in Dovecot. Please review the CVE identifiers referenced below for details.
Impact
A remote attacker could exploit these vulnerabilities to cause the remote execution of arbitrary code, or a Denial of Service condition, to conduct directory traversal attacks, corrupt data, or disclose information.
Workaround
There is no known workaround at this time.
Resolution
All Dovecot 1 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-1.2.17"
All Dovecot 2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.0.13"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since May 28, 2011. It is likely that your system is already no longer affected by this issue.
References
[ 1 ] CVE-2009-3235 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3235 [ 2 ] CVE-2009-3897 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3897 [ 3 ] CVE-2010-0745 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0745 [ 4 ] CVE-2010-3304 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3304 [ 5 ] CVE-2010-3706 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3706 [ 6 ] CVE-2010-3707 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3707 [ 7 ] CVE-2010-3779 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3779 [ 8 ] CVE-2010-3780 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3780 [ 9 ] CVE-2011-1929 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1929 [ 10 ] CVE-2011-2166 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2166 [ 11 ] CVE-2011-2167 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2167
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201110-04.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2011 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
.
Packages for 2009.0 are provided as of the Extended Maintenance Program. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFN3e9VmqjQ0CJFipgRAjwfAJ95TzNOzqcOHVs9I3gIj1PqbuH6+gCfaxLM TC22GorN3moiTA4Ska8YOLU= =2Q1M -----END PGP SIGNATURE-----
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ========================================================================== Ubuntu Security Notice USN-1143-1 June 02, 2011
dovecot vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.04
- Ubuntu 10.10
- Ubuntu 10.04 LTS
Summary:
An attacker could send a crafted email message that could disrupt email service.
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 11.04: dovecot-common 1:1.2.15-3ubuntu2.1
Ubuntu 10.10: dovecot-common 1:1.2.12-1ubuntu8.2
Ubuntu 10.04 LTS: dovecot-common 1:1.2.9-1ubuntu6.4
In general, a standard system update will make all the necessary changes.
The oldstable distribution (lenny) is not affected.
For the stable distribution (squeeze), this problem has been fixed in version 1.2.15-7.
For the unstable distribution (sid), this problem has been fixed in version 2.0.13-1
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201105-0095",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.12"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.1"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.0"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.6,
"vendor": "dovecot",
"version": "2.0.8"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.6,
"vendor": "dovecot",
"version": "2.0.7"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.6,
"vendor": "dovecot",
"version": "2.0"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.6,
"vendor": "dovecot",
"version": "2.0.9"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.6,
"vendor": "dovecot",
"version": "2.0.6"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.6,
"vendor": "dovecot",
"version": "2.0.10"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.6,
"vendor": "dovecot",
"version": "2.0.11"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "2.0.4"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "2.0.3"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "2.0.2"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "1.2.16"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "1.2.15"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "1.2.14"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "1.2.13"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "1.2.12"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "1.2.10"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "1.2.9"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "1.2.8"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "1.2.7"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "2.0.5"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "1.2.6"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "1.2.5"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "1.2.4"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "1.2.3"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "1.2.2"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.3,
"vendor": "dovecot",
"version": "1.2.11"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.0,
"vendor": "dovecot",
"version": "1.2.0"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.0,
"vendor": "dovecot",
"version": "1.2.1"
},
{
"model": "dovecot",
"scope": "lt",
"trust": 0.8,
"vendor": "timo sirainen",
"version": "1.2.17"
},
{
"model": "dovecot",
"scope": "lt",
"trust": 0.8,
"vendor": "timo sirainen",
"version": "2.0.13"
},
{
"model": "turbolinux appliance server",
"scope": "eq",
"trust": 0.8,
"vendor": "turbo linux",
"version": "3.0"
},
{
"model": "turbolinux appliance server",
"scope": "eq",
"trust": 0.8,
"vendor": "turbo linux",
"version": "3.0 (x64)"
},
{
"model": "turbolinux server",
"scope": "eq",
"trust": 0.8,
"vendor": "turbo linux",
"version": "11"
},
{
"model": "turbolinux server",
"scope": "eq",
"trust": 0.8,
"vendor": "turbo linux",
"version": "11 (x64)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (ws)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "5 (server)"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.0"
},
{
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "6"
},
{
"model": "enterprise linux server eus",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "6.1.z"
},
{
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "6"
},
{
"model": "rhel desktop workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "5 (client)"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.6,
"vendor": "dovecot",
"version": "1.2.x"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.6,
"vendor": "dovecot",
"version": "2.0.x"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.10"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.10"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.10"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.10"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "11.4"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "11.3"
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux workstation optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "enterprise linux server optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop workstation client",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2010.1"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2010.1"
},
{
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2009.0"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2009.0"
},
{
"model": "enterprise server x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "5"
},
{
"model": "enterprise server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "5"
},
{
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
},
{
"model": "dovecot",
"scope": "ne",
"trust": 0.3,
"vendor": "dovecot",
"version": "2.0.13"
},
{
"model": "dovecot",
"scope": "ne",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.2.17"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2132"
},
{
"db": "BID",
"id": "47930"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001934"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-250"
},
{
"db": "NVD",
"id": "CVE-2011-1929"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:1.2.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0:beta1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-1929"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Timo Sirainen",
"sources": [
{
"db": "BID",
"id": "47930"
}
],
"trust": 0.3
},
"cve": "CVE-2011-1929",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2011-1929",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-1929",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201105-250",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-001934"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-250"
},
{
"db": "NVD",
"id": "CVE-2011-1929"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle \u0027\\0\u0027 characters in header names, which allows remote attackers to cause a denial of service (daemon crash or mailbox corruption) via a crafted e-mail message. Dovecot is an open source IMAP and POP3 server for Linux/UNIX-like systems. Dovecot is prone to a denial-of-service vulnerability because it fails to properly parse message headers. \nA remote attacker can exploit this issue to crash the affected application, denying service to legitimate users. \nDovecot versions prior to 1.2.17 and 2.0.13 are vulnerable. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Moderate: dovecot security update\nAdvisory ID: RHSA-2011:1187-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://rhn.redhat.com/errata/RHSA-2011-1187.html\nIssue date: 2011-08-18\nCVE Names: CVE-2011-1929 \n=====================================================================\n\n1. Summary:\n\nUpdated dovecot packages that fix one security issue are now available for\nRed Hat Enterprise Linux 4, 5, and 6. \n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section. \n\n2. Relevant releases/architectures:\n\nRHEL Desktop Workstation (v. 5 client) - i386, x86_64\nRed Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64\nRed Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64\nRed Hat Enterprise Linux Desktop version 4 - i386, x86_64\nRed Hat Enterprise Linux ES version 4 - i386, ia64, x86_64\nRed Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64\nRed Hat Enterprise Linux WS version 4 - i386, ia64, x86_64\nRed Hat Enterprise Linux Workstation (v. 6) - i386, x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64\n\n3. \n(CVE-2011-1929)\n\nUsers of dovecot are advised to upgrade to these updated packages, which\ncontain a backported patch to resolve this issue. After installing the\nupdated packages, the dovecot service will be restarted automatically. \n\n4. Solution:\n\nBefore applying this update, make sure all previously-released errata\nrelevant to your system have been applied. \n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/kb/docs/DOC-11259\n\n5. Bugs fixed (http://bugzilla.redhat.com/):\n\n706286 - CVE-2011-1929 dovecot: potential crash when parsing header names that contain NUL characters\n\n6. Package List:\n\nRed Hat Enterprise Linux AS version 4:\n\nSource:\nftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/dovecot-0.99.11-10.EL4.src.rpm\n\ni386:\ndovecot-0.99.11-10.EL4.i386.rpm\ndovecot-debuginfo-0.99.11-10.EL4.i386.rpm\n\nia64:\ndovecot-0.99.11-10.EL4.ia64.rpm\ndovecot-debuginfo-0.99.11-10.EL4.ia64.rpm\n\nppc:\ndovecot-0.99.11-10.EL4.ppc.rpm\ndovecot-debuginfo-0.99.11-10.EL4.ppc.rpm\n\ns390:\ndovecot-0.99.11-10.EL4.s390.rpm\ndovecot-debuginfo-0.99.11-10.EL4.s390.rpm\n\ns390x:\ndovecot-0.99.11-10.EL4.s390x.rpm\ndovecot-debuginfo-0.99.11-10.EL4.s390x.rpm\n\nx86_64:\ndovecot-0.99.11-10.EL4.x86_64.rpm\ndovecot-debuginfo-0.99.11-10.EL4.x86_64.rpm\n\nRed Hat Enterprise Linux Desktop version 4:\n\nSource:\nftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/dovecot-0.99.11-10.EL4.src.rpm\n\ni386:\ndovecot-0.99.11-10.EL4.i386.rpm\ndovecot-debuginfo-0.99.11-10.EL4.i386.rpm\n\nx86_64:\ndovecot-0.99.11-10.EL4.x86_64.rpm\ndovecot-debuginfo-0.99.11-10.EL4.x86_64.rpm\n\nRed Hat Enterprise Linux ES version 4:\n\nSource:\nftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/dovecot-0.99.11-10.EL4.src.rpm\n\ni386:\ndovecot-0.99.11-10.EL4.i386.rpm\ndovecot-debuginfo-0.99.11-10.EL4.i386.rpm\n\nia64:\ndovecot-0.99.11-10.EL4.ia64.rpm\ndovecot-debuginfo-0.99.11-10.EL4.ia64.rpm\n\nx86_64:\ndovecot-0.99.11-10.EL4.x86_64.rpm\ndovecot-debuginfo-0.99.11-10.EL4.x86_64.rpm\n\nRed Hat Enterprise Linux WS version 4:\n\nSource:\nftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/dovecot-0.99.11-10.EL4.src.rpm\n\ni386:\ndovecot-0.99.11-10.EL4.i386.rpm\ndovecot-debuginfo-0.99.11-10.EL4.i386.rpm\n\nia64:\ndovecot-0.99.11-10.EL4.ia64.rpm\ndovecot-debuginfo-0.99.11-10.EL4.ia64.rpm\n\nx86_64:\ndovecot-0.99.11-10.EL4.x86_64.rpm\ndovecot-debuginfo-0.99.11-10.EL4.x86_64.rpm\n\nRHEL Desktop Workstation (v. 5 client):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/dovecot-1.0.7-7.el5_7.1.src.rpm\n\ni386:\ndovecot-1.0.7-7.el5_7.1.i386.rpm\ndovecot-debuginfo-1.0.7-7.el5_7.1.i386.rpm\n\nx86_64:\ndovecot-1.0.7-7.el5_7.1.x86_64.rpm\ndovecot-debuginfo-1.0.7-7.el5_7.1.x86_64.rpm\n\nRed Hat Enterprise Linux (v. 5 server):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/dovecot-1.0.7-7.el5_7.1.src.rpm\n\ni386:\ndovecot-1.0.7-7.el5_7.1.i386.rpm\ndovecot-debuginfo-1.0.7-7.el5_7.1.i386.rpm\n\nia64:\ndovecot-1.0.7-7.el5_7.1.ia64.rpm\ndovecot-debuginfo-1.0.7-7.el5_7.1.ia64.rpm\n\nppc:\ndovecot-1.0.7-7.el5_7.1.ppc.rpm\ndovecot-debuginfo-1.0.7-7.el5_7.1.ppc.rpm\n\ns390x:\ndovecot-1.0.7-7.el5_7.1.s390x.rpm\ndovecot-debuginfo-1.0.7-7.el5_7.1.s390x.rpm\n\nx86_64:\ndovecot-1.0.7-7.el5_7.1.x86_64.rpm\ndovecot-debuginfo-1.0.7-7.el5_7.1.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/dovecot-2.0.9-2.el6_1.1.src.rpm\n\ni386:\ndovecot-2.0.9-2.el6_1.1.i686.rpm\ndovecot-debuginfo-2.0.9-2.el6_1.1.i686.rpm\ndovecot-mysql-2.0.9-2.el6_1.1.i686.rpm\ndovecot-pgsql-2.0.9-2.el6_1.1.i686.rpm\ndovecot-pigeonhole-2.0.9-2.el6_1.1.i686.rpm\n\nppc64:\ndovecot-2.0.9-2.el6_1.1.ppc.rpm\ndovecot-2.0.9-2.el6_1.1.ppc64.rpm\ndovecot-debuginfo-2.0.9-2.el6_1.1.ppc.rpm\ndovecot-debuginfo-2.0.9-2.el6_1.1.ppc64.rpm\ndovecot-mysql-2.0.9-2.el6_1.1.ppc64.rpm\ndovecot-pgsql-2.0.9-2.el6_1.1.ppc64.rpm\ndovecot-pigeonhole-2.0.9-2.el6_1.1.ppc64.rpm\n\ns390x:\ndovecot-2.0.9-2.el6_1.1.s390.rpm\ndovecot-2.0.9-2.el6_1.1.s390x.rpm\ndovecot-debuginfo-2.0.9-2.el6_1.1.s390.rpm\ndovecot-debuginfo-2.0.9-2.el6_1.1.s390x.rpm\ndovecot-mysql-2.0.9-2.el6_1.1.s390x.rpm\ndovecot-pgsql-2.0.9-2.el6_1.1.s390x.rpm\ndovecot-pigeonhole-2.0.9-2.el6_1.1.s390x.rpm\n\nx86_64:\ndovecot-2.0.9-2.el6_1.1.i686.rpm\ndovecot-2.0.9-2.el6_1.1.x86_64.rpm\ndovecot-debuginfo-2.0.9-2.el6_1.1.i686.rpm\ndovecot-debuginfo-2.0.9-2.el6_1.1.x86_64.rpm\ndovecot-mysql-2.0.9-2.el6_1.1.x86_64.rpm\ndovecot-pgsql-2.0.9-2.el6_1.1.x86_64.rpm\ndovecot-pigeonhole-2.0.9-2.el6_1.1.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/dovecot-2.0.9-2.el6_1.1.src.rpm\n\ni386:\ndovecot-debuginfo-2.0.9-2.el6_1.1.i686.rpm\ndovecot-devel-2.0.9-2.el6_1.1.i686.rpm\n\nppc64:\ndovecot-debuginfo-2.0.9-2.el6_1.1.ppc64.rpm\ndovecot-devel-2.0.9-2.el6_1.1.ppc64.rpm\n\ns390x:\ndovecot-debuginfo-2.0.9-2.el6_1.1.s390x.rpm\ndovecot-devel-2.0.9-2.el6_1.1.s390x.rpm\n\nx86_64:\ndovecot-debuginfo-2.0.9-2.el6_1.1.x86_64.rpm\ndovecot-devel-2.0.9-2.el6_1.1.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/dovecot-2.0.9-2.el6_1.1.src.rpm\n\ni386:\ndovecot-2.0.9-2.el6_1.1.i686.rpm\ndovecot-debuginfo-2.0.9-2.el6_1.1.i686.rpm\ndovecot-mysql-2.0.9-2.el6_1.1.i686.rpm\ndovecot-pgsql-2.0.9-2.el6_1.1.i686.rpm\ndovecot-pigeonhole-2.0.9-2.el6_1.1.i686.rpm\n\nx86_64:\ndovecot-2.0.9-2.el6_1.1.i686.rpm\ndovecot-2.0.9-2.el6_1.1.x86_64.rpm\ndovecot-debuginfo-2.0.9-2.el6_1.1.i686.rpm\ndovecot-debuginfo-2.0.9-2.el6_1.1.x86_64.rpm\ndovecot-mysql-2.0.9-2.el6_1.1.x86_64.rpm\ndovecot-pgsql-2.0.9-2.el6_1.1.x86_64.rpm\ndovecot-pigeonhole-2.0.9-2.el6_1.1.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/dovecot-2.0.9-2.el6_1.1.src.rpm\n\ni386:\ndovecot-debuginfo-2.0.9-2.el6_1.1.i686.rpm\ndovecot-devel-2.0.9-2.el6_1.1.i686.rpm\n\nx86_64:\ndovecot-debuginfo-2.0.9-2.el6_1.1.x86_64.rpm\ndovecot-devel-2.0.9-2.el6_1.1.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and \ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/#package\n\n7. References:\n\nhttps://www.redhat.com/security/data/cve/CVE-2011-1929.html\nhttps://access.redhat.com/security/updates/classification/#moderate\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2011 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.4 (GNU/Linux)\n\niD8DBQFOTW29XlSAg2UNWIIRAr8LAKCu85vT3BXBKZ1SRebWK7B9nG6OFQCfYR3k\nP3AdaDf2BpXnEhk2OL5DTpo=\n=eG31\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201110-04\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: High\n Title: Dovecot: Multiple vulnerabilities\n Date: October 10, 2011\n Bugs: #286844, #293954, #314533, #368653\n ID: 201110-04\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities were found in Dovecot, the worst of which\nallowing for remote execution of arbitrary code. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 net-mail/dovecot \u003c 2.0.13 *\u003e= 1.2.17\n \u003e= 2.0.13\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in Dovecot. Please review\nthe CVE identifiers referenced below for details. \n\nImpact\n======\n\nA remote attacker could exploit these vulnerabilities to cause the\nremote execution of arbitrary code, or a Denial of Service condition,\nto conduct directory traversal attacks, corrupt data, or disclose\ninformation. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Dovecot 1 users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=net-mail/dovecot-1.2.17\"\n\nAll Dovecot 2 users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=net-mail/dovecot-2.0.13\"\n\nNOTE: This is a legacy GLSA. Updates for all affected architectures are\navailable since May 28, 2011. It is likely that your system is already\nno longer affected by this issue. \n\nReferences\n==========\n\n[ 1 ] CVE-2009-3235\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3235\n[ 2 ] CVE-2009-3897\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3897\n[ 3 ] CVE-2010-0745\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0745\n[ 4 ] CVE-2010-3304\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3304\n[ 5 ] CVE-2010-3706\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3706\n[ 6 ] CVE-2010-3707\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3707\n[ 7 ] CVE-2010-3779\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3779\n[ 8 ] CVE-2010-3780\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3780\n[ 9 ] CVE-2011-1929\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1929\n[ 10 ] CVE-2011-2166\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2166\n[ 11 ] CVE-2011-2167\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2167\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201110-04.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2011 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n\n\n\n. \n \n Packages for 2009.0 are provided as of the Extended Maintenance\n Program. The verification\n of md5 checksums and GPG signatures is performed automatically for you. \n\n All packages are signed by Mandriva for security. You can obtain the\n GPG public key of the Mandriva Security Team by executing:\n\n gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\n\n You can view other update advisories for Mandriva Linux at:\n\n http://www.mandriva.com/security/advisories\n\n If you want to report vulnerabilities, please contact\n\n security_(at)_mandriva.com\n _______________________________________________________________________\n\n Type Bits/KeyID Date User ID\n pub 1024D/22458A98 2000-07-10 Mandriva Security Team\n \u003csecurity*mandriva.com\u003e\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.9 (GNU/Linux)\n\niD8DBQFN3e9VmqjQ0CJFipgRAjwfAJ95TzNOzqcOHVs9I3gIj1PqbuH6+gCfaxLM\nTC22GorN3moiTA4Ska8YOLU=\n=2Q1M\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nFull-Disclosure - We believe in it. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n. ==========================================================================\nUbuntu Security Notice USN-1143-1\nJune 02, 2011\n\ndovecot vulnerability\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 11.04\n- Ubuntu 10.10\n- Ubuntu 10.04 LTS\n\nSummary:\n\nAn attacker could send a crafted email message that could disrupt email\nservice. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 11.04:\n dovecot-common 1:1.2.15-3ubuntu2.1\n\nUbuntu 10.10:\n dovecot-common 1:1.2.12-1ubuntu8.2\n\nUbuntu 10.04 LTS:\n dovecot-common 1:1.2.9-1ubuntu6.4\n\nIn general, a standard system update will make all the necessary changes. \n\n\nThe oldstable distribution (lenny) is not affected. \n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 1.2.15-7. \n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.0.13-1",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-1929"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001934"
},
{
"db": "CNVD",
"id": "CNVD-2011-2132"
},
{
"db": "BID",
"id": "47930"
},
{
"db": "PACKETSTORM",
"id": "104202"
},
{
"db": "PACKETSTORM",
"id": "105652"
},
{
"db": "PACKETSTORM",
"id": "101719"
},
{
"db": "PACKETSTORM",
"id": "101933"
},
{
"db": "PACKETSTORM",
"id": "101949"
}
],
"trust": 2.88
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-1929",
"trust": 3.8
},
{
"db": "BID",
"id": "47930",
"trust": 3.3
},
{
"db": "OSVDB",
"id": "72495",
"trust": 1.8
},
{
"db": "SECUNIA",
"id": "44683",
"trust": 1.8
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2011/05/19/6",
"trust": 1.6
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2011/05/19/3",
"trust": 1.6
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2011/05/18/4",
"trust": 1.6
},
{
"db": "SECUNIA",
"id": "44827",
"trust": 1.0
},
{
"db": "SECUNIA",
"id": "44712",
"trust": 1.0
},
{
"db": "SECUNIA",
"id": "44756",
"trust": 1.0
},
{
"db": "SECUNIA",
"id": "44771",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001934",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2011-2132",
"trust": 0.6
},
{
"db": "MLIST",
"id": "[DOVECOT] 20110511 V2.0.13 RELEASED",
"trust": 0.6
},
{
"db": "MLIST",
"id": "[DOVECOT] 20110511 V1.2.17 RELEASED",
"trust": 0.6
},
{
"db": "MLIST",
"id": "[OSS-SECURITY] 20110519 RE: DOVECOT RELEASES",
"trust": 0.6
},
{
"db": "MLIST",
"id": "[OSS-SECURITY] 20110518 DOVECOT RELEASES",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201105-250",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "104202",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "105652",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "101719",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "101933",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "101949",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2132"
},
{
"db": "BID",
"id": "47930"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001934"
},
{
"db": "PACKETSTORM",
"id": "104202"
},
{
"db": "PACKETSTORM",
"id": "105652"
},
{
"db": "PACKETSTORM",
"id": "101719"
},
{
"db": "PACKETSTORM",
"id": "101933"
},
{
"db": "PACKETSTORM",
"id": "101949"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-250"
},
{
"db": "NVD",
"id": "CVE-2011-1929"
}
]
},
"id": "VAR-201105-0095",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2132"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2132"
}
]
},
"last_update_date": "2024-07-23T19:37:05.868000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "v1.2.17 released",
"trust": 0.8,
"url": "http://dovecot.org/pipermail/dovecot/2011-may/059086.html"
},
{
"title": "v2.0.13 released",
"trust": 0.8,
"url": "http://dovecot.org/pipermail/dovecot/2011-may/059085.html"
},
{
"title": "dovecot-1.1 / changeset",
"trust": 0.8,
"url": "http://hg.dovecot.org/dovecot-1.1/rev/3698dfe0f21c"
},
{
"title": "RHSA-2011:1187",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2011-1187.html"
},
{
"title": "TLSA-2011-22",
"trust": 0.8,
"url": "http://www.turbolinux.co.jp/security/2011/tlsa-2011-22j.txt"
},
{
"title": "Dovecot denies service patch vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/4012"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2132"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001934"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-001934"
},
{
"db": "NVD",
"id": "CVE-2011-1929"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.0,
"url": "http://www.securityfocus.com/bid/47930"
},
{
"trust": 1.9,
"url": "http://dovecot.org/pipermail/dovecot/2011-may/059086.html"
},
{
"trust": 1.9,
"url": "http://dovecot.org/pipermail/dovecot/2011-may/059085.html"
},
{
"trust": 1.9,
"url": "http://hg.dovecot.org/dovecot-1.1/rev/3698dfe0f21c"
},
{
"trust": 1.8,
"url": "http://osvdb.org/72495"
},
{
"trust": 1.8,
"url": "http://secunia.com/advisories/44683"
},
{
"trust": 1.6,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=706286"
},
{
"trust": 1.6,
"url": "http://www.dovecot.org/doc/news-2.0"
},
{
"trust": 1.6,
"url": "http://www.dovecot.org/doc/news-1.2"
},
{
"trust": 1.6,
"url": "http://openwall.com/lists/oss-security/2011/05/19/6"
},
{
"trust": 1.6,
"url": "http://openwall.com/lists/oss-security/2011/05/19/3"
},
{
"trust": 1.6,
"url": "http://openwall.com/lists/oss-security/2011/05/18/4"
},
{
"trust": 1.0,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-june/061384.html"
},
{
"trust": 1.0,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-may/060815.html"
},
{
"trust": 1.0,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-may/060825.html"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/44712"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/44756"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/44771"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/44827"
},
{
"trust": 1.0,
"url": "http://www.debian.org/security/2011/dsa-2252"
},
{
"trust": 1.0,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2011:101"
},
{
"trust": 1.0,
"url": "http://www.redhat.com/support/errata/rhsa-2011-1187.html"
},
{
"trust": 1.0,
"url": "http://www.ubuntu.com/usn/usn-1143-1"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/67589"
},
{
"trust": 1.0,
"url": "https://hermes.opensuse.org/messages/8581790"
},
{
"trust": 0.9,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1929"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-1929"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1929"
},
{
"trust": 0.3,
"url": "http://www.dovecot.org/"
},
{
"trust": 0.2,
"url": "http://secunia.com/"
},
{
"trust": 0.2,
"url": "http://lists.grok.org.uk/full-disclosure-charter.html"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.1,
"url": "https://rhn.redhat.com/errata/rhsa-2011-1187.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/kb/docs/doc-11259"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/key/#package"
},
{
"trust": 0.1,
"url": "http://bugzilla.redhat.com/):"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-1929.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-1929"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3304"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3706"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-0745"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-3897"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3779"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-2167"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3707"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-3897"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3780"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-2166"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-3235"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/glsa/glsa-201110-04.xml"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-3235"
},
{
"trust": 0.1,
"url": "http://store.mandriva.com/product_info.php\\?cpath=149\\\u0026amp;products_id=490"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/security/"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/security/advisories"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/dovecot/1:1.2.15-3ubuntu2.1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/dovecot/1:1.2.12-1ubuntu8.2"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/dovecot/1:1.2.9-1ubuntu6.4"
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2132"
},
{
"db": "BID",
"id": "47930"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001934"
},
{
"db": "PACKETSTORM",
"id": "104202"
},
{
"db": "PACKETSTORM",
"id": "105652"
},
{
"db": "PACKETSTORM",
"id": "101719"
},
{
"db": "PACKETSTORM",
"id": "101933"
},
{
"db": "PACKETSTORM",
"id": "101949"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-250"
},
{
"db": "NVD",
"id": "CVE-2011-1929"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2011-2132"
},
{
"db": "BID",
"id": "47930"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001934"
},
{
"db": "PACKETSTORM",
"id": "104202"
},
{
"db": "PACKETSTORM",
"id": "105652"
},
{
"db": "PACKETSTORM",
"id": "101719"
},
{
"db": "PACKETSTORM",
"id": "101933"
},
{
"db": "PACKETSTORM",
"id": "101949"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-250"
},
{
"db": "NVD",
"id": "CVE-2011-1929"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-06-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-2132"
},
{
"date": "2011-05-19T00:00:00",
"db": "BID",
"id": "47930"
},
{
"date": "2011-07-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-001934"
},
{
"date": "2011-08-19T01:53:33",
"db": "PACKETSTORM",
"id": "104202"
},
{
"date": "2011-10-10T22:42:12",
"db": "PACKETSTORM",
"id": "105652"
},
{
"date": "2011-05-26T13:48:10",
"db": "PACKETSTORM",
"id": "101719"
},
{
"date": "2011-06-02T06:03:22",
"db": "PACKETSTORM",
"id": "101933"
},
{
"date": "2010-06-02T12:13:00",
"db": "PACKETSTORM",
"id": "101949"
},
{
"date": "2011-05-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201105-250"
},
{
"date": "2011-05-24T23:55:04.387000",
"db": "NVD",
"id": "CVE-2011-1929"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-06-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-2132"
},
{
"date": "2015-04-13T21:58:00",
"db": "BID",
"id": "47930"
},
{
"date": "2011-08-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-001934"
},
{
"date": "2011-05-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201105-250"
},
{
"date": "2017-08-17T01:34:28.213000",
"db": "NVD",
"id": "CVE-2011-1929"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "105652"
},
{
"db": "PACKETSTORM",
"id": "101719"
},
{
"db": "PACKETSTORM",
"id": "101933"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-250"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dovecot of lib-mail/message-header-parser.c Service disruption in (DoS) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-001934"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201105-250"
}
],
"trust": 0.6
}
}
VAR-201803-0134
Vulnerability from variot - Updated: 2023-12-18 12:57A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server. Dovecot Contains an out-of-bounds vulnerability and an information disclosure vulnerability.Information is obtained and service operation is interrupted (DoS) There is a possibility of being put into a state. Dovecot is an open source IMAP and POP3 mail server based on Linux/UNIX-like systems. A cross-boundary read vulnerability exists in Dovecot version 2.2.33.2. This vulnerability can be used to cause denial of service and access to sensitive information. Dovecot is prone to an information-disclosure vulnerability. Failed exploit attempts will result in a denial-of-service condition. Dovecot 2.2.33.2 is vulnerable; other versions may also be affected. ========================================================================== Ubuntu Security Notice USN-3587-2 April 02, 2018
dovecot vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in Dovecot. This update provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
It was discovered that Dovecot incorrectly handled parsing certain email addresses. (CVE-2017-14461)
It was discovered that Dovecot incorrectly handled TLS SNI config lookups. (CVE-2017-15130)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 12.04 ESM: dovecot-core 1:2.0.19-0ubuntu2.5
In general, a standard system update will make all the necessary changes.
References: https://usn.ubuntu.com/usn/usn-3587-2 https://usn.ubuntu.com/usn/usn-3587-1 CVE-2017-14461, CVE-2017-15130 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
Debian Security Advisory DSA-4130-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso March 02, 2018 https://www.debian.org/security/faq
Package : dovecot CVE ID : CVE-2017-14461 CVE-2017-15130 CVE-2017-15132 Debian Bug : 888432 891819 891820
Several vulnerabilities have been discovered in the Dovecot email server. The Common Vulnerabilities and Exposures project identifies the following issues:
CVE-2017-14461
Aleksandar Nikolic of Cisco Talos and 'flxflndy' discovered that
Dovecot does not properly parse invalid email addresses, which may
cause a crash or leak memory contents to an attacker.
CVE-2017-15130
It was discovered that TLS SNI config lookups may lead to excessive
memory usage, causing imap-login/pop3-login VSZ limit to be reached
and the process restarted, resulting in a denial of service. Only
Dovecot configurations containing local_name { } or local { }
configuration blocks are affected.
CVE-2017-15132
It was discovered that Dovecot contains a memory leak flaw in the
login process on aborted SASL authentication.
For the oldstable distribution (jessie), these problems have been fixed in version 1:2.2.13-12~deb8u4.
For the stable distribution (stretch), these problems have been fixed in version 1:2.2.27-3+deb9u2.
We recommend that you upgrade your dovecot packages.
For the detailed security status of dovecot please refer to its security tracker page at: https://security-tracker.debian.org/tracker/dovecot
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlqZzelfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0T8fg/+KmUzgEXDQFSnWOmSt+8GXFB08C2XtXmopMuej/1tjkZZ7B04vXfkgYZ9 u7zICbM56VrTmnXOYnLuXjqLrzGO0Y9jX+Z5G4BSw0TgP+g6ME72ZvqxuE4IKQqi QlaKTX86B1AMpzvkLrhwXlArJDr7pJzOonFJds6rKtVA4OvY4/fAAWrH89BFchet VwdO5rngcd/qnAYVOZglTMfgVlzxvenx+0fbQ6JFS6T8ODOFSsnwth64u3KY8yYj 4PGTBqX4m+2S2q2qGinueBgHNUV4RK71Zw1QYDa2gMBQR3HtlMnDhmQ4uYCvKP04 Z1GJYX6dMxMSWPKC2WecrdCSV+QAdMlYypKbhqcLA4LHcdPR+v35oQT4X/SYd2WS Zf50KMYUm9Q3YiOHVDrJo+o21hX4g8hRw1wdewZz+wyQ1n1TOlVtRh4vmACKRzNx 7bUayEvVU3q3VQd+dDH2Bl+TBiO7RB5/b2pHp8vHwAlVX00jYSSnoLUKT0L4BQ54 +1DZ8j88OFKDxTgOsbk19rhfraY7iejAjHZDVnJBwC/tB9REG6DOrDIG4OJqTKw4 sP1JaHryOGXzOf/8h61rY5HAuwofGkAZN7S+Bel0+zGYJvIcSyxpBKvJB/0TDNjm E5KphLFG9RGVmdeVkQzG6tGUMnMXxFrAD5U3hlzUsNGLLA+RE78= =Yh09 -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201803-0134",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.2.33.2"
},
{
"model": "ubuntu",
"scope": "eq",
"trust": 1.6,
"vendor": "ubuntu",
"version": "16.04"
},
{
"model": "ubuntu",
"scope": "eq",
"trust": 1.6,
"vendor": "ubuntu",
"version": "17.10"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "8.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "9.0"
},
{
"model": "ubuntu",
"scope": "eq",
"trust": 1.0,
"vendor": "ubuntu",
"version": "14.04"
},
{
"model": "ubuntu",
"scope": null,
"trust": 0.8,
"vendor": "canonical",
"version": null
},
{
"model": "gnu/linux",
"scope": null,
"trust": 0.8,
"vendor": "debian",
"version": null
},
{
"model": "dovecot",
"scope": null,
"trust": 0.8,
"vendor": "timo sirainen",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06399"
},
{
"db": "BID",
"id": "103201"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012764"
},
{
"db": "NVD",
"id": "CVE-2017-14461"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-607"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.2.33.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:ubuntu:ubuntu:14.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:ubuntu:ubuntu:16.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:ubuntu:ubuntu:17.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-14461"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Aleksandar Nikolic of Cisco Talos.",
"sources": [
{
"db": "BID",
"id": "103201"
}
],
"trust": 0.3
},
"cve": "CVE-2017-14461",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"impactScore": 4.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-14461",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "CNVD-2018-06399",
"impactScore": 4.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"impactScore": 4.2,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "talos-cna@cisco.com",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 1.6,
"impactScore": 4.2,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.1,
"baseSeverity": "High",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2017-14461",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-14461",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "talos-cna@cisco.com",
"id": "CVE-2017-14461",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2018-06399",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201709-607",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06399"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012764"
},
{
"db": "NVD",
"id": "CVE-2017-14461"
},
{
"db": "NVD",
"id": "CVE-2017-14461"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-607"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server. Dovecot Contains an out-of-bounds vulnerability and an information disclosure vulnerability.Information is obtained and service operation is interrupted (DoS) There is a possibility of being put into a state. Dovecot is an open source IMAP and POP3 mail server based on Linux/UNIX-like systems. A cross-boundary read vulnerability exists in Dovecot version 2.2.33.2. This vulnerability can be used to cause denial of service and access to sensitive information. Dovecot is prone to an information-disclosure vulnerability. Failed exploit attempts will result in a denial-of-service condition. \nDovecot 2.2.33.2 is vulnerable; other versions may also be affected. ==========================================================================\nUbuntu Security Notice USN-3587-2\nApril 02, 2018\n\ndovecot vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 12.04 ESM\n\nSummary:\n\nSeveral security issues were fixed in Dovecot. This update provides\nthe corresponding update for Ubuntu 12.04 ESM. \n\nOriginal advisory details:\n\n It was discovered that Dovecot incorrectly handled parsing certain\n email addresses. (CVE-2017-14461)\n\n It was discovered that Dovecot incorrectly handled TLS SNI config\n lookups. (CVE-2017-15130)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 12.04 ESM:\n dovecot-core 1:2.0.19-0ubuntu2.5\n\nIn general, a standard system update will make all the necessary\nchanges. \n\nReferences:\n https://usn.ubuntu.com/usn/usn-3587-2\n https://usn.ubuntu.com/usn/usn-3587-1\n CVE-2017-14461, CVE-2017-15130\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4130-1 security@debian.org\nhttps://www.debian.org/security/ Salvatore Bonaccorso\nMarch 02, 2018 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : dovecot\nCVE ID : CVE-2017-14461 CVE-2017-15130 CVE-2017-15132\nDebian Bug : 888432 891819 891820\n\nSeveral vulnerabilities have been discovered in the Dovecot email\nserver. The Common Vulnerabilities and Exposures project identifies the\nfollowing issues:\n\nCVE-2017-14461\n\n Aleksandar Nikolic of Cisco Talos and \u0027flxflndy\u0027 discovered that\n Dovecot does not properly parse invalid email addresses, which may\n cause a crash or leak memory contents to an attacker. \n\nCVE-2017-15130\n\n It was discovered that TLS SNI config lookups may lead to excessive\n memory usage, causing imap-login/pop3-login VSZ limit to be reached\n and the process restarted, resulting in a denial of service. Only\n Dovecot configurations containing local_name { } or local { }\n configuration blocks are affected. \n\nCVE-2017-15132\n\n It was discovered that Dovecot contains a memory leak flaw in the\n login process on aborted SASL authentication. \n\nFor the oldstable distribution (jessie), these problems have been fixed\nin version 1:2.2.13-12~deb8u4. \n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 1:2.2.27-3+deb9u2. \n\nWe recommend that you upgrade your dovecot packages. \n\nFor the detailed security status of dovecot please refer to its security\ntracker page at:\nhttps://security-tracker.debian.org/tracker/dovecot\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlqZzelfFIAAAAAALgAo\naXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2\nNDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND\nz0T8fg/+KmUzgEXDQFSnWOmSt+8GXFB08C2XtXmopMuej/1tjkZZ7B04vXfkgYZ9\nu7zICbM56VrTmnXOYnLuXjqLrzGO0Y9jX+Z5G4BSw0TgP+g6ME72ZvqxuE4IKQqi\nQlaKTX86B1AMpzvkLrhwXlArJDr7pJzOonFJds6rKtVA4OvY4/fAAWrH89BFchet\nVwdO5rngcd/qnAYVOZglTMfgVlzxvenx+0fbQ6JFS6T8ODOFSsnwth64u3KY8yYj\n4PGTBqX4m+2S2q2qGinueBgHNUV4RK71Zw1QYDa2gMBQR3HtlMnDhmQ4uYCvKP04\nZ1GJYX6dMxMSWPKC2WecrdCSV+QAdMlYypKbhqcLA4LHcdPR+v35oQT4X/SYd2WS\nZf50KMYUm9Q3YiOHVDrJo+o21hX4g8hRw1wdewZz+wyQ1n1TOlVtRh4vmACKRzNx\n7bUayEvVU3q3VQd+dDH2Bl+TBiO7RB5/b2pHp8vHwAlVX00jYSSnoLUKT0L4BQ54\n+1DZ8j88OFKDxTgOsbk19rhfraY7iejAjHZDVnJBwC/tB9REG6DOrDIG4OJqTKw4\nsP1JaHryOGXzOf/8h61rY5HAuwofGkAZN7S+Bel0+zGYJvIcSyxpBKvJB/0TDNjm\nE5KphLFG9RGVmdeVkQzG6tGUMnMXxFrAD5U3hlzUsNGLLA+RE78=\n=Yh09\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-14461"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012764"
},
{
"db": "CNVD",
"id": "CNVD-2018-06399"
},
{
"db": "BID",
"id": "103201"
},
{
"db": "PACKETSTORM",
"id": "147005"
},
{
"db": "PACKETSTORM",
"id": "146647"
},
{
"db": "PACKETSTORM",
"id": "146656"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-14461",
"trust": 3.6
},
{
"db": "TALOS",
"id": "TALOS-2017-0510",
"trust": 2.5
},
{
"db": "BID",
"id": "103201",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012764",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2018-06399",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201709-607",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "147005",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "146647",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "146656",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06399"
},
{
"db": "BID",
"id": "103201"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012764"
},
{
"db": "PACKETSTORM",
"id": "147005"
},
{
"db": "PACKETSTORM",
"id": "146647"
},
{
"db": "PACKETSTORM",
"id": "146656"
},
{
"db": "NVD",
"id": "CVE-2017-14461"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-607"
}
]
},
"id": "VAR-201803-0134",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06399"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06399"
}
]
},
"last_update_date": "2023-12-18T12:57:05.173000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "[SECURITY] [DLA 1333-1] dovecot security update",
"trust": 0.8,
"url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html"
},
{
"title": "DSA-4130",
"trust": 0.8,
"url": "https://www.debian.org/security/2018/dsa-4130"
},
{
"title": "[Dovecot-news] v2.2.34 released",
"trust": 0.8,
"url": "https://www.dovecot.org/list/dovecot-news/2018-february/000370.html"
},
{
"title": "USN-3587-1",
"trust": 0.8,
"url": "https://usn.ubuntu.com/3587-1/"
},
{
"title": "USN-3587-2",
"trust": 0.8,
"url": "https://usn.ubuntu.com/3587-2/"
},
{
"title": "Dovecot Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=190036"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-012764"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-607"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-125",
"trust": 1.8
},
{
"problemtype": "CWE-200",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-012764"
},
{
"db": "NVD",
"id": "CVE-2017-14461"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.2,
"url": "https://talosintelligence.com/vulnerability_reports/talos-2017-0510"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/103201"
},
{
"trust": 1.6,
"url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html"
},
{
"trust": 1.6,
"url": "https://usn.ubuntu.com/3587-1/"
},
{
"trust": 1.6,
"url": "https://usn.ubuntu.com/3587-2/"
},
{
"trust": 1.6,
"url": "https://www.debian.org/security/2018/dsa-4130"
},
{
"trust": 1.6,
"url": "https://www.dovecot.org/list/dovecot-news/2018-february/000370.html"
},
{
"trust": 1.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-14461"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-14461"
},
{
"trust": 0.3,
"url": "http://www.dovecot.org/"
},
{
"trust": 0.3,
"url": "https://www.talosintelligence.com/vulnerability_reports/talos-2017-0510"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-15130"
},
{
"trust": 0.2,
"url": "https://usn.ubuntu.com/usn/usn-3587-1"
},
{
"trust": 0.1,
"url": "https://usn.ubuntu.com/usn/usn-3587-2"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/dovecot/1:2.2.9-1ubuntu2.4"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/dovecot/1:2.2.22-1ubuntu2.7"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/dovecot/1:2.2.27-3ubuntu1.3"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-15132"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://security-tracker.debian.org/tracker/dovecot"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06399"
},
{
"db": "BID",
"id": "103201"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012764"
},
{
"db": "PACKETSTORM",
"id": "147005"
},
{
"db": "PACKETSTORM",
"id": "146647"
},
{
"db": "PACKETSTORM",
"id": "146656"
},
{
"db": "NVD",
"id": "CVE-2017-14461"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-607"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2018-06399"
},
{
"db": "BID",
"id": "103201"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012764"
},
{
"db": "PACKETSTORM",
"id": "147005"
},
{
"db": "PACKETSTORM",
"id": "146647"
},
{
"db": "PACKETSTORM",
"id": "146656"
},
{
"db": "NVD",
"id": "CVE-2017-14461"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-607"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-27T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-06399"
},
{
"date": "2018-03-01T00:00:00",
"db": "BID",
"id": "103201"
},
{
"date": "2018-04-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-012764"
},
{
"date": "2018-04-02T16:54:55",
"db": "PACKETSTORM",
"id": "147005"
},
{
"date": "2018-03-05T22:23:00",
"db": "PACKETSTORM",
"id": "146647"
},
{
"date": "2018-03-05T23:45:22",
"db": "PACKETSTORM",
"id": "146656"
},
{
"date": "2018-03-02T15:29:00.210000",
"db": "NVD",
"id": "CVE-2017-14461"
},
{
"date": "2017-09-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201709-607"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-27T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-06399"
},
{
"date": "2018-03-01T00:00:00",
"db": "BID",
"id": "103201"
},
{
"date": "2018-04-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-012764"
},
{
"date": "2022-04-19T19:15:17.503000",
"db": "NVD",
"id": "CVE-2017-14461"
},
{
"date": "2022-04-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201709-607"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "147005"
},
{
"db": "PACKETSTORM",
"id": "146647"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-607"
}
],
"trust": 0.8
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dovecot Vulnerable to out-of-bounds reading",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-012764"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201709-607"
}
],
"trust": 0.6
}
}
VAR-201803-1087
Vulnerability from variot - Updated: 2023-12-18 12:57A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart. dovecot Contains a resource management vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Dovecot is an open source IMAP and POP3 mail server based on Linux/UNIX-like systems. ========================================================================== Ubuntu Security Notice USN-3587-2 April 02, 2018
dovecot vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in Dovecot. This update provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
It was discovered that Dovecot incorrectly handled parsing certain email addresses. (CVE-2017-14461)
It was discovered that Dovecot incorrectly handled TLS SNI config lookups. A remote attacker could possibly use this issue to cause Dovecot to crash, resulting in a denial of service. (CVE-2017-15130)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 12.04 ESM: dovecot-core 1:2.0.19-0ubuntu2.5
In general, a standard system update will make all the necessary changes.
References: https://usn.ubuntu.com/usn/usn-3587-2 https://usn.ubuntu.com/usn/usn-3587-1 CVE-2017-14461, CVE-2017-15130 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
Debian Security Advisory DSA-4130-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso March 02, 2018 https://www.debian.org/security/faq
Package : dovecot CVE ID : CVE-2017-14461 CVE-2017-15130 CVE-2017-15132 Debian Bug : 888432 891819 891820
Several vulnerabilities have been discovered in the Dovecot email server. The Common Vulnerabilities and Exposures project identifies the following issues:
CVE-2017-14461
Aleksandar Nikolic of Cisco Talos and 'flxflndy' discovered that
Dovecot does not properly parse invalid email addresses, which may
cause a crash or leak memory contents to an attacker. Only
Dovecot configurations containing local_name { } or local { }
configuration blocks are affected.
CVE-2017-15132
It was discovered that Dovecot contains a memory leak flaw in the
login process on aborted SASL authentication.
For the oldstable distribution (jessie), these problems have been fixed in version 1:2.2.13-12~deb8u4.
For the stable distribution (stretch), these problems have been fixed in version 1:2.2.27-3+deb9u2.
We recommend that you upgrade your dovecot packages.
For the detailed security status of dovecot please refer to its security tracker page at: https://security-tracker.debian.org/tracker/dovecot
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlqZzelfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0T8fg/+KmUzgEXDQFSnWOmSt+8GXFB08C2XtXmopMuej/1tjkZZ7B04vXfkgYZ9 u7zICbM56VrTmnXOYnLuXjqLrzGO0Y9jX+Z5G4BSw0TgP+g6ME72ZvqxuE4IKQqi QlaKTX86B1AMpzvkLrhwXlArJDr7pJzOonFJds6rKtVA4OvY4/fAAWrH89BFchet VwdO5rngcd/qnAYVOZglTMfgVlzxvenx+0fbQ6JFS6T8ODOFSsnwth64u3KY8yYj 4PGTBqX4m+2S2q2qGinueBgHNUV4RK71Zw1QYDa2gMBQR3HtlMnDhmQ4uYCvKP04 Z1GJYX6dMxMSWPKC2WecrdCSV+QAdMlYypKbhqcLA4LHcdPR+v35oQT4X/SYd2WS Zf50KMYUm9Q3YiOHVDrJo+o21hX4g8hRw1wdewZz+wyQ1n1TOlVtRh4vmACKRzNx 7bUayEvVU3q3VQd+dDH2Bl+TBiO7RB5/b2pHp8vHwAlVX00jYSSnoLUKT0L4BQ54 +1DZ8j88OFKDxTgOsbk19rhfraY7iejAjHZDVnJBwC/tB9REG6DOrDIG4OJqTKw4 sP1JaHryOGXzOf/8h61rY5HAuwofGkAZN7S+Bel0+zGYJvIcSyxpBKvJB/0TDNjm E5KphLFG9RGVmdeVkQzG6tGUMnMXxFrAD5U3hlzUsNGLLA+RE78= =Yh09 -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201803-1087",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dovecot",
"scope": "lt",
"trust": 1.6,
"vendor": "dovecot",
"version": "2.2.34"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.6,
"vendor": "canonical",
"version": "17.10"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "8.0"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "14.04"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "16.04"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "9.0"
},
{
"model": "ubuntu",
"scope": null,
"trust": 0.8,
"vendor": "canonical",
"version": null
},
{
"model": "gnu/linux",
"scope": null,
"trust": 0.8,
"vendor": "debian",
"version": null
},
{
"model": "dovecot",
"scope": "lt",
"trust": 0.8,
"vendor": "timo sirainen",
"version": "2.2.34"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05070"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012758"
},
{
"db": "NVD",
"id": "CVE-2017-15130"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-092"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.2.34",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-15130"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ubuntu",
"sources": [
{
"db": "PACKETSTORM",
"id": "147005"
},
{
"db": "PACKETSTORM",
"id": "146647"
}
],
"trust": 0.2
},
"cve": "CVE-2017-15130",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2017-15130",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"exploitabilityScore": 4.9,
"id": "CNVD-2018-05070",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "High",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 5.9,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2017-15130",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-15130",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2018-05070",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201803-092",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05070"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012758"
},
{
"db": "NVD",
"id": "CVE-2017-15130"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-092"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart. dovecot Contains a resource management vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Dovecot is an open source IMAP and POP3 mail server based on Linux/UNIX-like systems. ==========================================================================\nUbuntu Security Notice USN-3587-2\nApril 02, 2018\n\ndovecot vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 12.04 ESM\n\nSummary:\n\nSeveral security issues were fixed in Dovecot. This update provides\nthe corresponding update for Ubuntu 12.04 ESM. \n\nOriginal advisory details:\n\n It was discovered that Dovecot incorrectly handled parsing certain\n email addresses. (CVE-2017-14461)\n\n It was discovered that Dovecot incorrectly handled TLS SNI config\n lookups. A remote attacker could possibly use this issue to cause\n Dovecot to crash, resulting in a denial of service. (CVE-2017-15130)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 12.04 ESM:\n dovecot-core 1:2.0.19-0ubuntu2.5\n\nIn general, a standard system update will make all the necessary\nchanges. \n\nReferences:\n https://usn.ubuntu.com/usn/usn-3587-2\n https://usn.ubuntu.com/usn/usn-3587-1\n CVE-2017-14461, CVE-2017-15130\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4130-1 security@debian.org\nhttps://www.debian.org/security/ Salvatore Bonaccorso\nMarch 02, 2018 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : dovecot\nCVE ID : CVE-2017-14461 CVE-2017-15130 CVE-2017-15132\nDebian Bug : 888432 891819 891820\n\nSeveral vulnerabilities have been discovered in the Dovecot email\nserver. The Common Vulnerabilities and Exposures project identifies the\nfollowing issues:\n\nCVE-2017-14461\n\n Aleksandar Nikolic of Cisco Talos and \u0027flxflndy\u0027 discovered that\n Dovecot does not properly parse invalid email addresses, which may\n cause a crash or leak memory contents to an attacker. Only\n Dovecot configurations containing local_name { } or local { }\n configuration blocks are affected. \n\nCVE-2017-15132\n\n It was discovered that Dovecot contains a memory leak flaw in the\n login process on aborted SASL authentication. \n\nFor the oldstable distribution (jessie), these problems have been fixed\nin version 1:2.2.13-12~deb8u4. \n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 1:2.2.27-3+deb9u2. \n\nWe recommend that you upgrade your dovecot packages. \n\nFor the detailed security status of dovecot please refer to its security\ntracker page at:\nhttps://security-tracker.debian.org/tracker/dovecot\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlqZzelfFIAAAAAALgAo\naXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2\nNDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND\nz0T8fg/+KmUzgEXDQFSnWOmSt+8GXFB08C2XtXmopMuej/1tjkZZ7B04vXfkgYZ9\nu7zICbM56VrTmnXOYnLuXjqLrzGO0Y9jX+Z5G4BSw0TgP+g6ME72ZvqxuE4IKQqi\nQlaKTX86B1AMpzvkLrhwXlArJDr7pJzOonFJds6rKtVA4OvY4/fAAWrH89BFchet\nVwdO5rngcd/qnAYVOZglTMfgVlzxvenx+0fbQ6JFS6T8ODOFSsnwth64u3KY8yYj\n4PGTBqX4m+2S2q2qGinueBgHNUV4RK71Zw1QYDa2gMBQR3HtlMnDhmQ4uYCvKP04\nZ1GJYX6dMxMSWPKC2WecrdCSV+QAdMlYypKbhqcLA4LHcdPR+v35oQT4X/SYd2WS\nZf50KMYUm9Q3YiOHVDrJo+o21hX4g8hRw1wdewZz+wyQ1n1TOlVtRh4vmACKRzNx\n7bUayEvVU3q3VQd+dDH2Bl+TBiO7RB5/b2pHp8vHwAlVX00jYSSnoLUKT0L4BQ54\n+1DZ8j88OFKDxTgOsbk19rhfraY7iejAjHZDVnJBwC/tB9REG6DOrDIG4OJqTKw4\nsP1JaHryOGXzOf/8h61rY5HAuwofGkAZN7S+Bel0+zGYJvIcSyxpBKvJB/0TDNjm\nE5KphLFG9RGVmdeVkQzG6tGUMnMXxFrAD5U3hlzUsNGLLA+RE78=\n=Yh09\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-15130"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012758"
},
{
"db": "CNVD",
"id": "CNVD-2018-05070"
},
{
"db": "PACKETSTORM",
"id": "147005"
},
{
"db": "PACKETSTORM",
"id": "146647"
},
{
"db": "PACKETSTORM",
"id": "146656"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-15130",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012758",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2018-05070",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201803-092",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "147005",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "146647",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "146656",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05070"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012758"
},
{
"db": "PACKETSTORM",
"id": "147005"
},
{
"db": "PACKETSTORM",
"id": "146647"
},
{
"db": "PACKETSTORM",
"id": "146656"
},
{
"db": "NVD",
"id": "CVE-2017-15130"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-092"
}
]
},
"id": "VAR-201803-1087",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05070"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05070"
}
]
},
"last_update_date": "2023-12-18T12:57:05.135000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "[SECURITY] [DLA 1333-1] dovecot security update",
"trust": 0.8,
"url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html"
},
{
"title": "DSA-4130",
"trust": 0.8,
"url": "https://www.debian.org/security/2018/dsa-4130"
},
{
"title": "[Dovecot-news] v2.2.34 released",
"trust": 0.8,
"url": "https://www.dovecot.org/list/dovecot-news/2018-february/000370.html"
},
{
"title": "USN-3587-1",
"trust": 0.8,
"url": "https://usn.ubuntu.com/3587-1/"
},
{
"title": "USN-3587-2",
"trust": 0.8,
"url": "https://usn.ubuntu.com/3587-2/"
},
{
"title": "Patch for dovecot denial of service vulnerability (CNVD-2018-05070)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/121071"
},
{
"title": "Dovecot Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=78880"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05070"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012758"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-092"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-399",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-012758"
},
{
"db": "NVD",
"id": "CVE-2017-15130"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-15130"
},
{
"trust": 1.6,
"url": "http://seclists.org/oss-sec/2018/q1/205"
},
{
"trust": 1.6,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1532356"
},
{
"trust": 1.6,
"url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html"
},
{
"trust": 1.6,
"url": "https://usn.ubuntu.com/3587-1/"
},
{
"trust": 1.6,
"url": "https://usn.ubuntu.com/3587-2/"
},
{
"trust": 1.6,
"url": "https://www.debian.org/security/2018/dsa-4130"
},
{
"trust": 1.6,
"url": "https://www.dovecot.org/list/dovecot-news/2018-february/000370.html"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-15130"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-14461"
},
{
"trust": 0.2,
"url": "https://usn.ubuntu.com/usn/usn-3587-1"
},
{
"trust": 0.1,
"url": "https://usn.ubuntu.com/usn/usn-3587-2"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/dovecot/1:2.2.9-1ubuntu2.4"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/dovecot/1:2.2.22-1ubuntu2.7"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/dovecot/1:2.2.27-3ubuntu1.3"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-15132"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://security-tracker.debian.org/tracker/dovecot"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05070"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012758"
},
{
"db": "PACKETSTORM",
"id": "147005"
},
{
"db": "PACKETSTORM",
"id": "146647"
},
{
"db": "PACKETSTORM",
"id": "146656"
},
{
"db": "NVD",
"id": "CVE-2017-15130"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-092"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2018-05070"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012758"
},
{
"db": "PACKETSTORM",
"id": "147005"
},
{
"db": "PACKETSTORM",
"id": "146647"
},
{
"db": "PACKETSTORM",
"id": "146656"
},
{
"db": "NVD",
"id": "CVE-2017-15130"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-092"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-05070"
},
{
"date": "2018-04-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-012758"
},
{
"date": "2018-04-02T16:54:55",
"db": "PACKETSTORM",
"id": "147005"
},
{
"date": "2018-03-05T22:23:00",
"db": "PACKETSTORM",
"id": "146647"
},
{
"date": "2018-03-05T23:45:22",
"db": "PACKETSTORM",
"id": "146656"
},
{
"date": "2018-03-02T15:29:00.273000",
"db": "NVD",
"id": "CVE-2017-15130"
},
{
"date": "2018-03-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201803-092"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-05070"
},
{
"date": "2018-04-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-012758"
},
{
"date": "2019-10-03T00:03:26.223000",
"db": "NVD",
"id": "CVE-2017-15130"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201803-092"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "147005"
},
{
"db": "PACKETSTORM",
"id": "146647"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-092"
}
],
"trust": 0.8
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "dovecot Resource management vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-012758"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "resource management error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201803-092"
}
],
"trust": 0.6
}
}
VAR-201003-0202
Vulnerability from variot - Updated: 2023-12-18 11:52Dovecot in Apple Mac OS X 10.6 before 10.6.3, when Kerberos is enabled, does not properly enforce the service access control list (SACL) for sending and receiving e-mail, which allows remote authenticated users to bypass intended access restrictions via unspecified vectors. Dovecot is prone to a security-bypass vulnerability. An authenticated attacker may perform unauthorized email actions. NOTE: This issue was previously covered in BID 39020 (Apple Mac OS X APPLE-SA-2010-03-29-1 Multiple Security Vulnerabilities) but has been assigned its own record to better document it. Mac OS X is the operating system used by the Apple family of machines. Permissions and access control vulnerabilities exist in Dovecot for Apple Mac OS
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201003-0202",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.6.1"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.6.0"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.6.1"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.6.2"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.6.2"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.6.0"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.6 to v10.6.2"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.6 to v10.6.2"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.2.8"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.2.7"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.1.6"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.1.5"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.1.4"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0.15"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0.13"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0.12"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0.11"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0.10"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0.9"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0.8"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0.7"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0.6"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0.5"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0.4"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0.3"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.2"
},
{
"model": "1.1rc3",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.1rc2",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.0.rc9",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.0.rc8",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.0.rc7",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.0.rc6",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.0.rc5",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.0.rc4",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.0.rc3",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.0.rc2",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.0.rc15",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.0.rc14",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.0.rc13",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.0.rc12",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.0.rc11",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.0.rc10",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.0.beta3",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "1.0.beta2",
"scope": null,
"trust": 0.3,
"vendor": "dovecot",
"version": null
},
{
"model": "rc29",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0"
},
{
"model": "rc1",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0"
},
{
"model": "beta8",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0"
},
{
"model": "beta7",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "1.0"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6"
},
{
"model": "mac os server",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.3"
},
{
"model": "mac os",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.3"
}
],
"sources": [
{
"db": "BID",
"id": "39258"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001253"
},
{
"db": "NVD",
"id": "CVE-2010-0535"
},
{
"db": "CNNVD",
"id": "CNNVD-201003-491"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x_server:10.6.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.6.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.6.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x_server:10.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x_server:10.6.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-0535"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Michael KisorDamian Put\u203b pucik@cc-team.org",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201003-491"
}
],
"trust": 0.6
},
"cve": "CVE-2010-0535",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2010-0535",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "VHN-43140",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-0535",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201003-491",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-43140",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-43140"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001253"
},
{
"db": "NVD",
"id": "CVE-2010-0535"
},
{
"db": "CNNVD",
"id": "CNNVD-201003-491"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dovecot in Apple Mac OS X 10.6 before 10.6.3, when Kerberos is enabled, does not properly enforce the service access control list (SACL) for sending and receiving e-mail, which allows remote authenticated users to bypass intended access restrictions via unspecified vectors. Dovecot is prone to a security-bypass vulnerability. \nAn authenticated attacker may perform unauthorized email actions. \nNOTE: This issue was previously covered in BID 39020 (Apple Mac OS X APPLE-SA-2010-03-29-1 Multiple Security Vulnerabilities) but has been assigned its own record to better document it. Mac OS X is the operating system used by the Apple family of machines. Permissions and access control vulnerabilities exist in Dovecot for Apple Mac OS",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-0535"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001253"
},
{
"db": "BID",
"id": "39258"
},
{
"db": "VULHUB",
"id": "VHN-43140"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-0535",
"trust": 2.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001253",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201003-491",
"trust": 0.7
},
{
"db": "NSFOCUS",
"id": "14715",
"trust": 0.6
},
{
"db": "APPLE",
"id": "APPLE-SA-2010-03-29-1",
"trust": 0.6
},
{
"db": "BID",
"id": "39258",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-43140",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-43140"
},
{
"db": "BID",
"id": "39258"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001253"
},
{
"db": "NVD",
"id": "CVE-2010-0535"
},
{
"db": "CNNVD",
"id": "CNNVD-201003-491"
}
]
},
"id": "VAR-201003-0202",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-43140"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T11:52:46.802000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT4077",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht4077"
},
{
"title": "HT4077",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht4077?viewlocale=ja_jp"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001253"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-43140"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001253"
},
{
"db": "NVD",
"id": "CVE-2010-0535"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2010//mar/msg00001.html"
},
{
"trust": 1.7,
"url": "http://support.apple.com/kb/ht4077"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0535"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-0535"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/14715"
},
{
"trust": 0.3,
"url": "http://www.dovecot.org/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-43140"
},
{
"db": "BID",
"id": "39258"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001253"
},
{
"db": "NVD",
"id": "CVE-2010-0535"
},
{
"db": "CNNVD",
"id": "CNNVD-201003-491"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-43140"
},
{
"db": "BID",
"id": "39258"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001253"
},
{
"db": "NVD",
"id": "CVE-2010-0535"
},
{
"db": "CNNVD",
"id": "CNNVD-201003-491"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-03-30T00:00:00",
"db": "VULHUB",
"id": "VHN-43140"
},
{
"date": "2010-03-29T00:00:00",
"db": "BID",
"id": "39258"
},
{
"date": "2010-04-14T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001253"
},
{
"date": "2010-03-30T18:30:01.407000",
"db": "NVD",
"id": "CVE-2010-0535"
},
{
"date": "2010-03-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201003-491"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-06-21T00:00:00",
"db": "VULHUB",
"id": "VHN-43140"
},
{
"date": "2010-03-29T00:00:00",
"db": "BID",
"id": "39258"
},
{
"date": "2010-04-14T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001253"
},
{
"date": "2010-06-21T04:00:00",
"db": "NVD",
"id": "CVE-2010-0535"
},
{
"date": "2010-04-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201003-491"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201003-491"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple Mac OS X of Dovecot Vulnerable to access restrictions",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001253"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201003-491"
}
],
"trust": 0.6
}
}
VAR-201105-0289
Vulnerability from variot - Updated: 2023-12-18 11:00script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration settings, which might allow remote authenticated users to bypass intended access restrictions by leveraging a script. Dovecot is an open source IMAP and POP3 server for Linux/UNIX-like systems. Dovecot is prone to multiple security-bypass vulnerabilities because it fails to properly implement certain configuration settings. Authenticated attackers can exploit these issues to bypass certain security restrictions and perform unauthorized actions. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
===================================================================== Red Hat Security Advisory
Synopsis: Low: dovecot security and bug fix update Advisory ID: RHSA-2013:0520-02 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-0520.html Issue date: 2013-02-21 CVE Names: CVE-2011-2166 CVE-2011-2167 CVE-2011-4318 =====================================================================
- Summary:
Updated dovecot packages that fix three security issues and one bug are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64
- It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are provided as sub-packages.
Two flaws were found in the way some settings were enforced by the script-login functionality of Dovecot. (CVE-2011-2166, CVE-2011-2167)
A flaw was found in the way Dovecot performed remote server identity verification, when it was configured to proxy IMAP and POP3 connections to remote hosts using TLS/SSL protocols. A remote attacker could use this flaw to conduct man-in-the-middle attacks using an X.509 certificate issued by a trusted Certificate Authority (for a different name). (CVE-2011-4318)
This update also fixes the following bug:
- When a new user first accessed their IMAP inbox, Dovecot was, under some circumstances, unable to change the group ownership of the inbox directory in the user's Maildir location to match that of the user's mail spool (/var/mail/$USER). This correctly generated an "Internal error occurred" message. However, with a subsequent attempt to access the inbox, Dovecot saw that the directory already existed and proceeded with its operation, leaving the directory with incorrectly set permissions. This update corrects the underlying permissions setting error. When a new user now accesses their inbox for the first time, and it is not possible to set group ownership, Dovecot removes the created directory and generates an error message instead of keeping the directory with incorrect group ownership. (BZ#697620)
Users of dovecot are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the dovecot service will be restarted automatically.
- Solution:
Before applying this update, make sure all previously-released errata relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258
- Package List:
Red Hat Enterprise Linux Server (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/dovecot-2.0.9-5.el6.src.rpm
i386: dovecot-2.0.9-5.el6.i686.rpm dovecot-debuginfo-2.0.9-5.el6.i686.rpm dovecot-mysql-2.0.9-5.el6.i686.rpm dovecot-pgsql-2.0.9-5.el6.i686.rpm dovecot-pigeonhole-2.0.9-5.el6.i686.rpm
ppc64: dovecot-2.0.9-5.el6.ppc.rpm dovecot-2.0.9-5.el6.ppc64.rpm dovecot-debuginfo-2.0.9-5.el6.ppc.rpm dovecot-debuginfo-2.0.9-5.el6.ppc64.rpm dovecot-mysql-2.0.9-5.el6.ppc64.rpm dovecot-pgsql-2.0.9-5.el6.ppc64.rpm dovecot-pigeonhole-2.0.9-5.el6.ppc64.rpm
s390x: dovecot-2.0.9-5.el6.s390.rpm dovecot-2.0.9-5.el6.s390x.rpm dovecot-debuginfo-2.0.9-5.el6.s390.rpm dovecot-debuginfo-2.0.9-5.el6.s390x.rpm dovecot-mysql-2.0.9-5.el6.s390x.rpm dovecot-pgsql-2.0.9-5.el6.s390x.rpm dovecot-pigeonhole-2.0.9-5.el6.s390x.rpm
x86_64: dovecot-2.0.9-5.el6.i686.rpm dovecot-2.0.9-5.el6.x86_64.rpm dovecot-debuginfo-2.0.9-5.el6.i686.rpm dovecot-debuginfo-2.0.9-5.el6.x86_64.rpm dovecot-mysql-2.0.9-5.el6.x86_64.rpm dovecot-pgsql-2.0.9-5.el6.x86_64.rpm dovecot-pigeonhole-2.0.9-5.el6.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/dovecot-2.0.9-5.el6.src.rpm
i386: dovecot-debuginfo-2.0.9-5.el6.i686.rpm dovecot-devel-2.0.9-5.el6.i686.rpm
ppc64: dovecot-debuginfo-2.0.9-5.el6.ppc64.rpm dovecot-devel-2.0.9-5.el6.ppc64.rpm
s390x: dovecot-debuginfo-2.0.9-5.el6.s390x.rpm dovecot-devel-2.0.9-5.el6.s390x.rpm
x86_64: dovecot-debuginfo-2.0.9-5.el6.x86_64.rpm dovecot-devel-2.0.9-5.el6.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/dovecot-2.0.9-5.el6.src.rpm
i386: dovecot-2.0.9-5.el6.i686.rpm dovecot-debuginfo-2.0.9-5.el6.i686.rpm dovecot-mysql-2.0.9-5.el6.i686.rpm dovecot-pgsql-2.0.9-5.el6.i686.rpm dovecot-pigeonhole-2.0.9-5.el6.i686.rpm
x86_64: dovecot-2.0.9-5.el6.i686.rpm dovecot-2.0.9-5.el6.x86_64.rpm dovecot-debuginfo-2.0.9-5.el6.i686.rpm dovecot-debuginfo-2.0.9-5.el6.x86_64.rpm dovecot-mysql-2.0.9-5.el6.x86_64.rpm dovecot-pgsql-2.0.9-5.el6.x86_64.rpm dovecot-pigeonhole-2.0.9-5.el6.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/dovecot-2.0.9-5.el6.src.rpm
i386: dovecot-debuginfo-2.0.9-5.el6.i686.rpm dovecot-devel-2.0.9-5.el6.i686.rpm
x86_64: dovecot-debuginfo-2.0.9-5.el6.x86_64.rpm dovecot-devel-2.0.9-5.el6.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package
- References:
https://www.redhat.com/security/data/cve/CVE-2011-2166.html https://www.redhat.com/security/data/cve/CVE-2011-2167.html https://www.redhat.com/security/data/cve/CVE-2011-4318.html https://access.redhat.com/security/updates/classification/#low
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFRJcMBXlSAg2UNWIIRAsLkAKCVzudrg6y2jNbVu8TARQH65FPliACgpPzA 3cvEfHEUoK/fdUBZNDEuZqU= =9rAE -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201110-04
http://security.gentoo.org/
Severity: High Title: Dovecot: Multiple vulnerabilities Date: October 10, 2011 Bugs: #286844, #293954, #314533, #368653 ID: 201110-04
Synopsis
Multiple vulnerabilities were found in Dovecot, the worst of which allowing for remote execution of arbitrary code. Please review the CVE identifiers referenced below for details.
Impact
A remote attacker could exploit these vulnerabilities to cause the remote execution of arbitrary code, or a Denial of Service condition, to conduct directory traversal attacks, corrupt data, or disclose information.
Workaround
There is no known workaround at this time.
Resolution
All Dovecot 1 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-1.2.17"
All Dovecot 2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.0.13"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since May 28, 2011. It is likely that your system is already no longer affected by this issue.
References
[ 1 ] CVE-2009-3235 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3235 [ 2 ] CVE-2009-3897 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3897 [ 3 ] CVE-2010-0745 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0745 [ 4 ] CVE-2010-3304 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3304 [ 5 ] CVE-2010-3706 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3706 [ 6 ] CVE-2010-3707 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3707 [ 7 ] CVE-2010-3779 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3779 [ 8 ] CVE-2010-3780 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3780 [ 9 ] CVE-2011-1929 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1929 [ 10 ] CVE-2011-2166 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2166 [ 11 ] CVE-2011-2167 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2167
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201110-04.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2011 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201105-0289",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.12"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.3"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.5"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.0"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.1"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.2"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.4"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.6,
"vendor": "dovecot",
"version": "2.0.8"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.6,
"vendor": "dovecot",
"version": "2.0.9"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.6,
"vendor": "dovecot",
"version": "2.0.7"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.0,
"vendor": "dovecot",
"version": "2.0.10"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.0,
"vendor": "dovecot",
"version": "2.0.11"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.0,
"vendor": "dovecot",
"version": "2.0.6"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.8,
"vendor": "timo sirainen",
"version": "2.0.13"
},
{
"model": "dovecot",
"scope": "lt",
"trust": 0.8,
"vendor": "timo sirainen",
"version": "2.0.x"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.6,
"vendor": "dovecot",
"version": "2.0.x"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "2.0"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6.2"
},
{
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6"
},
{
"model": "beta1",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "2.0"
},
{
"model": "dovecot",
"scope": "ne",
"trust": 0.3,
"vendor": "dovecot",
"version": "2.0.13"
},
{
"model": "centos",
"scope": "eq",
"trust": 0.3,
"vendor": "centos",
"version": "6"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2131"
},
{
"db": "BID",
"id": "48003"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004653"
},
{
"db": "NVD",
"id": "CVE-2011-2166"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-251"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-2166"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Reported by the vendor.",
"sources": [
{
"db": "BID",
"id": "48003"
}
],
"trust": 0.3
},
"cve": "CVE-2011-2166",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-2166",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-2166",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201105-251",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-004653"
},
{
"db": "NVD",
"id": "CVE-2011-2166"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-251"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration settings, which might allow remote authenticated users to bypass intended access restrictions by leveraging a script. Dovecot is an open source IMAP and POP3 server for Linux/UNIX-like systems. Dovecot is prone to multiple security-bypass vulnerabilities because it fails to properly implement certain configuration settings. \nAuthenticated attackers can exploit these issues to bypass certain security restrictions and perform unauthorized actions. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Low: dovecot security and bug fix update\nAdvisory ID: RHSA-2013:0520-02\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://rhn.redhat.com/errata/RHSA-2013-0520.html\nIssue date: 2013-02-21\nCVE Names: CVE-2011-2166 CVE-2011-2167 CVE-2011-4318 \n=====================================================================\n\n1. Summary:\n\nUpdated dovecot packages that fix three security issues and one bug are now\navailable for Red Hat Enterprise Linux 6. \n\nThe Red Hat Security Response Team has rated this update as having low\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64\nRed Hat Enterprise Linux Workstation (v. 6) - i386, x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64\n\n3. It\nsupports mail in either of maildir or mbox formats. The SQL drivers and\nauthentication plug-ins are provided as sub-packages. \n\nTwo flaws were found in the way some settings were enforced by the\nscript-login functionality of Dovecot. (CVE-2011-2166,\nCVE-2011-2167)\n\nA flaw was found in the way Dovecot performed remote server identity\nverification, when it was configured to proxy IMAP and POP3 connections to\nremote hosts using TLS/SSL protocols. A remote attacker could use this flaw\nto conduct man-in-the-middle attacks using an X.509 certificate issued by\na trusted Certificate Authority (for a different name). (CVE-2011-4318)\n\nThis update also fixes the following bug:\n\n* When a new user first accessed their IMAP inbox, Dovecot was, under some\ncircumstances, unable to change the group ownership of the inbox directory\nin the user\u0027s Maildir location to match that of the user\u0027s mail spool\n(/var/mail/$USER). This correctly generated an \"Internal error occurred\"\nmessage. However, with a subsequent attempt to access the inbox, Dovecot\nsaw that the directory already existed and proceeded with its operation,\nleaving the directory with incorrectly set permissions. This update\ncorrects the underlying permissions setting error. When a new user now\naccesses their inbox for the first time, and it is not possible to set\ngroup ownership, Dovecot removes the created directory and generates an\nerror message instead of keeping the directory with incorrect group\nownership. (BZ#697620)\n\nUsers of dovecot are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues. After installing the\nupdated packages, the dovecot service will be restarted automatically. \n\n4. Solution:\n\nBefore applying this update, make sure all previously-released errata\nrelevant to your system have been applied. \n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258\n\n5. Package List:\n\nRed Hat Enterprise Linux Server (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/dovecot-2.0.9-5.el6.src.rpm\n\ni386:\ndovecot-2.0.9-5.el6.i686.rpm\ndovecot-debuginfo-2.0.9-5.el6.i686.rpm\ndovecot-mysql-2.0.9-5.el6.i686.rpm\ndovecot-pgsql-2.0.9-5.el6.i686.rpm\ndovecot-pigeonhole-2.0.9-5.el6.i686.rpm\n\nppc64:\ndovecot-2.0.9-5.el6.ppc.rpm\ndovecot-2.0.9-5.el6.ppc64.rpm\ndovecot-debuginfo-2.0.9-5.el6.ppc.rpm\ndovecot-debuginfo-2.0.9-5.el6.ppc64.rpm\ndovecot-mysql-2.0.9-5.el6.ppc64.rpm\ndovecot-pgsql-2.0.9-5.el6.ppc64.rpm\ndovecot-pigeonhole-2.0.9-5.el6.ppc64.rpm\n\ns390x:\ndovecot-2.0.9-5.el6.s390.rpm\ndovecot-2.0.9-5.el6.s390x.rpm\ndovecot-debuginfo-2.0.9-5.el6.s390.rpm\ndovecot-debuginfo-2.0.9-5.el6.s390x.rpm\ndovecot-mysql-2.0.9-5.el6.s390x.rpm\ndovecot-pgsql-2.0.9-5.el6.s390x.rpm\ndovecot-pigeonhole-2.0.9-5.el6.s390x.rpm\n\nx86_64:\ndovecot-2.0.9-5.el6.i686.rpm\ndovecot-2.0.9-5.el6.x86_64.rpm\ndovecot-debuginfo-2.0.9-5.el6.i686.rpm\ndovecot-debuginfo-2.0.9-5.el6.x86_64.rpm\ndovecot-mysql-2.0.9-5.el6.x86_64.rpm\ndovecot-pgsql-2.0.9-5.el6.x86_64.rpm\ndovecot-pigeonhole-2.0.9-5.el6.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/dovecot-2.0.9-5.el6.src.rpm\n\ni386:\ndovecot-debuginfo-2.0.9-5.el6.i686.rpm\ndovecot-devel-2.0.9-5.el6.i686.rpm\n\nppc64:\ndovecot-debuginfo-2.0.9-5.el6.ppc64.rpm\ndovecot-devel-2.0.9-5.el6.ppc64.rpm\n\ns390x:\ndovecot-debuginfo-2.0.9-5.el6.s390x.rpm\ndovecot-devel-2.0.9-5.el6.s390x.rpm\n\nx86_64:\ndovecot-debuginfo-2.0.9-5.el6.x86_64.rpm\ndovecot-devel-2.0.9-5.el6.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/dovecot-2.0.9-5.el6.src.rpm\n\ni386:\ndovecot-2.0.9-5.el6.i686.rpm\ndovecot-debuginfo-2.0.9-5.el6.i686.rpm\ndovecot-mysql-2.0.9-5.el6.i686.rpm\ndovecot-pgsql-2.0.9-5.el6.i686.rpm\ndovecot-pigeonhole-2.0.9-5.el6.i686.rpm\n\nx86_64:\ndovecot-2.0.9-5.el6.i686.rpm\ndovecot-2.0.9-5.el6.x86_64.rpm\ndovecot-debuginfo-2.0.9-5.el6.i686.rpm\ndovecot-debuginfo-2.0.9-5.el6.x86_64.rpm\ndovecot-mysql-2.0.9-5.el6.x86_64.rpm\ndovecot-pgsql-2.0.9-5.el6.x86_64.rpm\ndovecot-pigeonhole-2.0.9-5.el6.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/dovecot-2.0.9-5.el6.src.rpm\n\ni386:\ndovecot-debuginfo-2.0.9-5.el6.i686.rpm\ndovecot-devel-2.0.9-5.el6.i686.rpm\n\nx86_64:\ndovecot-debuginfo-2.0.9-5.el6.x86_64.rpm\ndovecot-devel-2.0.9-5.el6.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/#package\n\n7. References:\n\nhttps://www.redhat.com/security/data/cve/CVE-2011-2166.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-2167.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-4318.html\nhttps://access.redhat.com/security/updates/classification/#low\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2013 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.4 (GNU/Linux)\n\niD8DBQFRJcMBXlSAg2UNWIIRAsLkAKCVzudrg6y2jNbVu8TARQH65FPliACgpPzA\n3cvEfHEUoK/fdUBZNDEuZqU=\n=9rAE\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201110-04\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: High\n Title: Dovecot: Multiple vulnerabilities\n Date: October 10, 2011\n Bugs: #286844, #293954, #314533, #368653\n ID: 201110-04\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities were found in Dovecot, the worst of which\nallowing for remote execution of arbitrary code. Please review\nthe CVE identifiers referenced below for details. \n\nImpact\n======\n\nA remote attacker could exploit these vulnerabilities to cause the\nremote execution of arbitrary code, or a Denial of Service condition,\nto conduct directory traversal attacks, corrupt data, or disclose\ninformation. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Dovecot 1 users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=net-mail/dovecot-1.2.17\"\n\nAll Dovecot 2 users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=net-mail/dovecot-2.0.13\"\n\nNOTE: This is a legacy GLSA. Updates for all affected architectures are\navailable since May 28, 2011. It is likely that your system is already\nno longer affected by this issue. \n\nReferences\n==========\n\n[ 1 ] CVE-2009-3235\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3235\n[ 2 ] CVE-2009-3897\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3897\n[ 3 ] CVE-2010-0745\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0745\n[ 4 ] CVE-2010-3304\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3304\n[ 5 ] CVE-2010-3706\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3706\n[ 6 ] CVE-2010-3707\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3707\n[ 7 ] CVE-2010-3779\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3779\n[ 8 ] CVE-2010-3780\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3780\n[ 9 ] CVE-2011-1929\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1929\n[ 10 ] CVE-2011-2166\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2166\n[ 11 ] CVE-2011-2167\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2167\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201110-04.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2011 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-2166"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004653"
},
{
"db": "CNVD",
"id": "CNVD-2011-2131"
},
{
"db": "BID",
"id": "48003"
},
{
"db": "PACKETSTORM",
"id": "120446"
},
{
"db": "PACKETSTORM",
"id": "105652"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-2166",
"trust": 3.5
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2011/05/18/4",
"trust": 1.6
},
{
"db": "BID",
"id": "48003",
"trust": 1.3
},
{
"db": "SECUNIA",
"id": "52311",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004653",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2011-2131",
"trust": 0.6
},
{
"db": "MLIST",
"id": "[DOVECOT] 20110511 V2.0.13 RELEASED",
"trust": 0.6
},
{
"db": "MLIST",
"id": "[OSS-SECURITY] 20110518 DOVECOT RELEASES",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201105-251",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "120446",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "105652",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2131"
},
{
"db": "BID",
"id": "48003"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004653"
},
{
"db": "PACKETSTORM",
"id": "120446"
},
{
"db": "PACKETSTORM",
"id": "105652"
},
{
"db": "NVD",
"id": "CVE-2011-2166"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-251"
}
]
},
"id": "VAR-201105-0289",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2131"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2131"
}
]
},
"last_update_date": "2023-12-18T11:00:16.663000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "NEWS-2.0",
"trust": 0.8,
"url": "http://www.dovecot.org/doc/news-2.0"
},
{
"title": "Dovecot configuration error vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/4011"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2131"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004653"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-16",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-004653"
},
{
"db": "NVD",
"id": "CVE-2011-2166"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://dovecot.org/pipermail/dovecot/2011-may/059085.html"
},
{
"trust": 1.6,
"url": "http://openwall.com/lists/oss-security/2011/05/18/4"
},
{
"trust": 1.6,
"url": "http://www.dovecot.org/doc/news-2.0"
},
{
"trust": 1.1,
"url": "http://rhn.redhat.com/errata/rhsa-2013-0520.html"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/52311"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/bid/48003"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/67675"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2166"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-2166"
},
{
"trust": 0.3,
"url": "http://www.dovecot.org/"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2166"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-4318.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-2166.html"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-2167.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/key/#package"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4318"
},
{
"trust": 0.1,
"url": "http://bugzilla.redhat.com/):"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2167"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/knowledge/articles/11258"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-1929"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3304"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3706"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-0745"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-3897"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3779"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-2167"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3707"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-3897"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3780"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-2166"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-3235"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/glsa/glsa-201110-04.xml"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-3235"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2131"
},
{
"db": "BID",
"id": "48003"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004653"
},
{
"db": "PACKETSTORM",
"id": "120446"
},
{
"db": "PACKETSTORM",
"id": "105652"
},
{
"db": "NVD",
"id": "CVE-2011-2166"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-251"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2011-2131"
},
{
"db": "BID",
"id": "48003"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004653"
},
{
"db": "PACKETSTORM",
"id": "120446"
},
{
"db": "PACKETSTORM",
"id": "105652"
},
{
"db": "NVD",
"id": "CVE-2011-2166"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-251"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-06-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-2131"
},
{
"date": "2011-05-26T00:00:00",
"db": "BID",
"id": "48003"
},
{
"date": "2012-03-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-004653"
},
{
"date": "2013-02-21T16:28:44",
"db": "PACKETSTORM",
"id": "120446"
},
{
"date": "2011-10-10T22:42:12",
"db": "PACKETSTORM",
"id": "105652"
},
{
"date": "2011-05-24T23:55:04.433000",
"db": "NVD",
"id": "CVE-2011-2166"
},
{
"date": "2011-05-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201105-251"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-06-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-2131"
},
{
"date": "2013-03-11T06:54:00",
"db": "BID",
"id": "48003"
},
{
"date": "2012-03-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-004653"
},
{
"date": "2017-08-29T01:29:19.190000",
"db": "NVD",
"id": "CVE-2011-2166"
},
{
"date": "2011-05-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201105-251"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "120446"
},
{
"db": "PACKETSTORM",
"id": "105652"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-251"
}
],
"trust": 0.8
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dovecot of script-login Vulnerable to access restrictions",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-004653"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "configuration error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201105-251"
}
],
"trust": 0.6
}
}
VAR-201105-0290
Vulnerability from variot - Updated: 2023-12-18 10:58script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote authenticated users to conduct directory traversal attacks by leveraging a script. Dovecot is an open source IMAP and POP3 server for Linux/UNIX-like systems. The script-login in version 2.0.x prior to Dovecot 2.0.13 did not follow the chroot configuration. Dovecot is prone to multiple security-bypass vulnerabilities because it fails to properly implement certain configuration settings. Authenticated attackers can exploit these issues to bypass certain security restrictions and perform unauthorized actions. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
===================================================================== Red Hat Security Advisory
Synopsis: Low: dovecot security and bug fix update Advisory ID: RHSA-2013:0520-02 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-0520.html Issue date: 2013-02-21 CVE Names: CVE-2011-2166 CVE-2011-2167 CVE-2011-4318 =====================================================================
- Summary:
Updated dovecot packages that fix three security issues and one bug are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64
- It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are provided as sub-packages.
Two flaws were found in the way some settings were enforced by the script-login functionality of Dovecot. (CVE-2011-2166, CVE-2011-2167)
A flaw was found in the way Dovecot performed remote server identity verification, when it was configured to proxy IMAP and POP3 connections to remote hosts using TLS/SSL protocols. A remote attacker could use this flaw to conduct man-in-the-middle attacks using an X.509 certificate issued by a trusted Certificate Authority (for a different name). (CVE-2011-4318)
This update also fixes the following bug:
- When a new user first accessed their IMAP inbox, Dovecot was, under some circumstances, unable to change the group ownership of the inbox directory in the user's Maildir location to match that of the user's mail spool (/var/mail/$USER). This correctly generated an "Internal error occurred" message. However, with a subsequent attempt to access the inbox, Dovecot saw that the directory already existed and proceeded with its operation, leaving the directory with incorrectly set permissions. This update corrects the underlying permissions setting error. When a new user now accesses their inbox for the first time, and it is not possible to set group ownership, Dovecot removes the created directory and generates an error message instead of keeping the directory with incorrect group ownership. (BZ#697620)
Users of dovecot are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the dovecot service will be restarted automatically.
- Solution:
Before applying this update, make sure all previously-released errata relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258
- Bugs fixed (http://bugzilla.redhat.com/):
709095 - CVE-2011-2166 dovecot: authenticated remote bypass of intended access restrictions 709097 - CVE-2011-2167 dovecot: directory traversal due to not obeying chroot directive 754980 - CVE-2011-4318 dovecot: proxy destination host name not checked against SSL certificate name
- Package List:
Red Hat Enterprise Linux Server (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/dovecot-2.0.9-5.el6.src.rpm
i386: dovecot-2.0.9-5.el6.i686.rpm dovecot-debuginfo-2.0.9-5.el6.i686.rpm dovecot-mysql-2.0.9-5.el6.i686.rpm dovecot-pgsql-2.0.9-5.el6.i686.rpm dovecot-pigeonhole-2.0.9-5.el6.i686.rpm
ppc64: dovecot-2.0.9-5.el6.ppc.rpm dovecot-2.0.9-5.el6.ppc64.rpm dovecot-debuginfo-2.0.9-5.el6.ppc.rpm dovecot-debuginfo-2.0.9-5.el6.ppc64.rpm dovecot-mysql-2.0.9-5.el6.ppc64.rpm dovecot-pgsql-2.0.9-5.el6.ppc64.rpm dovecot-pigeonhole-2.0.9-5.el6.ppc64.rpm
s390x: dovecot-2.0.9-5.el6.s390.rpm dovecot-2.0.9-5.el6.s390x.rpm dovecot-debuginfo-2.0.9-5.el6.s390.rpm dovecot-debuginfo-2.0.9-5.el6.s390x.rpm dovecot-mysql-2.0.9-5.el6.s390x.rpm dovecot-pgsql-2.0.9-5.el6.s390x.rpm dovecot-pigeonhole-2.0.9-5.el6.s390x.rpm
x86_64: dovecot-2.0.9-5.el6.i686.rpm dovecot-2.0.9-5.el6.x86_64.rpm dovecot-debuginfo-2.0.9-5.el6.i686.rpm dovecot-debuginfo-2.0.9-5.el6.x86_64.rpm dovecot-mysql-2.0.9-5.el6.x86_64.rpm dovecot-pgsql-2.0.9-5.el6.x86_64.rpm dovecot-pigeonhole-2.0.9-5.el6.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/dovecot-2.0.9-5.el6.src.rpm
i386: dovecot-debuginfo-2.0.9-5.el6.i686.rpm dovecot-devel-2.0.9-5.el6.i686.rpm
ppc64: dovecot-debuginfo-2.0.9-5.el6.ppc64.rpm dovecot-devel-2.0.9-5.el6.ppc64.rpm
s390x: dovecot-debuginfo-2.0.9-5.el6.s390x.rpm dovecot-devel-2.0.9-5.el6.s390x.rpm
x86_64: dovecot-debuginfo-2.0.9-5.el6.x86_64.rpm dovecot-devel-2.0.9-5.el6.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/dovecot-2.0.9-5.el6.src.rpm
i386: dovecot-2.0.9-5.el6.i686.rpm dovecot-debuginfo-2.0.9-5.el6.i686.rpm dovecot-mysql-2.0.9-5.el6.i686.rpm dovecot-pgsql-2.0.9-5.el6.i686.rpm dovecot-pigeonhole-2.0.9-5.el6.i686.rpm
x86_64: dovecot-2.0.9-5.el6.i686.rpm dovecot-2.0.9-5.el6.x86_64.rpm dovecot-debuginfo-2.0.9-5.el6.i686.rpm dovecot-debuginfo-2.0.9-5.el6.x86_64.rpm dovecot-mysql-2.0.9-5.el6.x86_64.rpm dovecot-pgsql-2.0.9-5.el6.x86_64.rpm dovecot-pigeonhole-2.0.9-5.el6.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/dovecot-2.0.9-5.el6.src.rpm
i386: dovecot-debuginfo-2.0.9-5.el6.i686.rpm dovecot-devel-2.0.9-5.el6.i686.rpm
x86_64: dovecot-debuginfo-2.0.9-5.el6.x86_64.rpm dovecot-devel-2.0.9-5.el6.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package
- References:
https://www.redhat.com/security/data/cve/CVE-2011-2166.html https://www.redhat.com/security/data/cve/CVE-2011-2167.html https://www.redhat.com/security/data/cve/CVE-2011-4318.html https://access.redhat.com/security/updates/classification/#low
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFRJcMBXlSAg2UNWIIRAsLkAKCVzudrg6y2jNbVu8TARQH65FPliACgpPzA 3cvEfHEUoK/fdUBZNDEuZqU= =9rAE -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201110-04
http://security.gentoo.org/
Severity: High Title: Dovecot: Multiple vulnerabilities Date: October 10, 2011 Bugs: #286844, #293954, #314533, #368653 ID: 201110-04
Synopsis
Multiple vulnerabilities were found in Dovecot, the worst of which allowing for remote execution of arbitrary code. Please review the CVE identifiers referenced below for details.
Impact
A remote attacker could exploit these vulnerabilities to cause the remote execution of arbitrary code, or a Denial of Service condition, to conduct directory traversal attacks, corrupt data, or disclose information.
Workaround
There is no known workaround at this time.
Resolution
All Dovecot 1 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-1.2.17"
All Dovecot 2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-2.0.13"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since May 28, 2011. It is likely that your system is already no longer affected by this issue.
References
[ 1 ] CVE-2009-3235 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3235 [ 2 ] CVE-2009-3897 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3897 [ 3 ] CVE-2010-0745 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0745 [ 4 ] CVE-2010-3304 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3304 [ 5 ] CVE-2010-3706 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3706 [ 6 ] CVE-2010-3707 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3707 [ 7 ] CVE-2010-3779 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3779 [ 8 ] CVE-2010-3780 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3780 [ 9 ] CVE-2011-1929 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1929 [ 10 ] CVE-2011-2166 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2166 [ 11 ] CVE-2011-2167 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2167
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201110-04.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2011 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201105-0290",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.12"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.3"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.5"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.0"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.1"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.2"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.9,
"vendor": "dovecot",
"version": "2.0.4"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.6,
"vendor": "dovecot",
"version": "2.0.8"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.6,
"vendor": "dovecot",
"version": "2.0.9"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.6,
"vendor": "dovecot",
"version": "2.0.7"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.0,
"vendor": "dovecot",
"version": "2.0.10"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.0,
"vendor": "dovecot",
"version": "2.0.11"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 1.0,
"vendor": "dovecot",
"version": "2.0.6"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.8,
"vendor": "timo sirainen",
"version": "2.0.13"
},
{
"model": "dovecot",
"scope": "lt",
"trust": 0.8,
"vendor": "timo sirainen",
"version": "2.0.x"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.6,
"vendor": "dovecot",
"version": "2.0.x"
},
{
"model": "dovecot",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "2.0"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6.2"
},
{
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6"
},
{
"model": "beta1",
"scope": "eq",
"trust": 0.3,
"vendor": "dovecot",
"version": "2.0"
},
{
"model": "dovecot",
"scope": "ne",
"trust": 0.3,
"vendor": "dovecot",
"version": "2.0.13"
},
{
"model": "centos",
"scope": "eq",
"trust": 0.3,
"vendor": "centos",
"version": "6"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2129"
},
{
"db": "BID",
"id": "48003"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004654"
},
{
"db": "NVD",
"id": "CVE-2011-2167"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-252"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:dovecot:dovecot:2.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-2167"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Reported by the vendor.",
"sources": [
{
"db": "BID",
"id": "48003"
}
],
"trust": 0.3
},
"cve": "CVE-2011-2167",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-2167",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-2167",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201105-252",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-004654"
},
{
"db": "NVD",
"id": "CVE-2011-2167"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-252"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote authenticated users to conduct directory traversal attacks by leveraging a script. Dovecot is an open source IMAP and POP3 server for Linux/UNIX-like systems. The script-login in version 2.0.x prior to Dovecot 2.0.13 did not follow the chroot configuration. Dovecot is prone to multiple security-bypass vulnerabilities because it fails to properly implement certain configuration settings. \nAuthenticated attackers can exploit these issues to bypass certain security restrictions and perform unauthorized actions. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Low: dovecot security and bug fix update\nAdvisory ID: RHSA-2013:0520-02\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://rhn.redhat.com/errata/RHSA-2013-0520.html\nIssue date: 2013-02-21\nCVE Names: CVE-2011-2166 CVE-2011-2167 CVE-2011-4318 \n=====================================================================\n\n1. Summary:\n\nUpdated dovecot packages that fix three security issues and one bug are now\navailable for Red Hat Enterprise Linux 6. \n\nThe Red Hat Security Response Team has rated this update as having low\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64\nRed Hat Enterprise Linux Workstation (v. 6) - i386, x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64\n\n3. It\nsupports mail in either of maildir or mbox formats. The SQL drivers and\nauthentication plug-ins are provided as sub-packages. \n\nTwo flaws were found in the way some settings were enforced by the\nscript-login functionality of Dovecot. (CVE-2011-2166,\nCVE-2011-2167)\n\nA flaw was found in the way Dovecot performed remote server identity\nverification, when it was configured to proxy IMAP and POP3 connections to\nremote hosts using TLS/SSL protocols. A remote attacker could use this flaw\nto conduct man-in-the-middle attacks using an X.509 certificate issued by\na trusted Certificate Authority (for a different name). (CVE-2011-4318)\n\nThis update also fixes the following bug:\n\n* When a new user first accessed their IMAP inbox, Dovecot was, under some\ncircumstances, unable to change the group ownership of the inbox directory\nin the user\u0027s Maildir location to match that of the user\u0027s mail spool\n(/var/mail/$USER). This correctly generated an \"Internal error occurred\"\nmessage. However, with a subsequent attempt to access the inbox, Dovecot\nsaw that the directory already existed and proceeded with its operation,\nleaving the directory with incorrectly set permissions. This update\ncorrects the underlying permissions setting error. When a new user now\naccesses their inbox for the first time, and it is not possible to set\ngroup ownership, Dovecot removes the created directory and generates an\nerror message instead of keeping the directory with incorrect group\nownership. (BZ#697620)\n\nUsers of dovecot are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues. After installing the\nupdated packages, the dovecot service will be restarted automatically. \n\n4. Solution:\n\nBefore applying this update, make sure all previously-released errata\nrelevant to your system have been applied. \n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258\n\n5. Bugs fixed (http://bugzilla.redhat.com/):\n\n709095 - CVE-2011-2166 dovecot: authenticated remote bypass of intended access restrictions\n709097 - CVE-2011-2167 dovecot: directory traversal due to not obeying chroot directive\n754980 - CVE-2011-4318 dovecot: proxy destination host name not checked against SSL certificate name\n\n6. Package List:\n\nRed Hat Enterprise Linux Server (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/dovecot-2.0.9-5.el6.src.rpm\n\ni386:\ndovecot-2.0.9-5.el6.i686.rpm\ndovecot-debuginfo-2.0.9-5.el6.i686.rpm\ndovecot-mysql-2.0.9-5.el6.i686.rpm\ndovecot-pgsql-2.0.9-5.el6.i686.rpm\ndovecot-pigeonhole-2.0.9-5.el6.i686.rpm\n\nppc64:\ndovecot-2.0.9-5.el6.ppc.rpm\ndovecot-2.0.9-5.el6.ppc64.rpm\ndovecot-debuginfo-2.0.9-5.el6.ppc.rpm\ndovecot-debuginfo-2.0.9-5.el6.ppc64.rpm\ndovecot-mysql-2.0.9-5.el6.ppc64.rpm\ndovecot-pgsql-2.0.9-5.el6.ppc64.rpm\ndovecot-pigeonhole-2.0.9-5.el6.ppc64.rpm\n\ns390x:\ndovecot-2.0.9-5.el6.s390.rpm\ndovecot-2.0.9-5.el6.s390x.rpm\ndovecot-debuginfo-2.0.9-5.el6.s390.rpm\ndovecot-debuginfo-2.0.9-5.el6.s390x.rpm\ndovecot-mysql-2.0.9-5.el6.s390x.rpm\ndovecot-pgsql-2.0.9-5.el6.s390x.rpm\ndovecot-pigeonhole-2.0.9-5.el6.s390x.rpm\n\nx86_64:\ndovecot-2.0.9-5.el6.i686.rpm\ndovecot-2.0.9-5.el6.x86_64.rpm\ndovecot-debuginfo-2.0.9-5.el6.i686.rpm\ndovecot-debuginfo-2.0.9-5.el6.x86_64.rpm\ndovecot-mysql-2.0.9-5.el6.x86_64.rpm\ndovecot-pgsql-2.0.9-5.el6.x86_64.rpm\ndovecot-pigeonhole-2.0.9-5.el6.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/dovecot-2.0.9-5.el6.src.rpm\n\ni386:\ndovecot-debuginfo-2.0.9-5.el6.i686.rpm\ndovecot-devel-2.0.9-5.el6.i686.rpm\n\nppc64:\ndovecot-debuginfo-2.0.9-5.el6.ppc64.rpm\ndovecot-devel-2.0.9-5.el6.ppc64.rpm\n\ns390x:\ndovecot-debuginfo-2.0.9-5.el6.s390x.rpm\ndovecot-devel-2.0.9-5.el6.s390x.rpm\n\nx86_64:\ndovecot-debuginfo-2.0.9-5.el6.x86_64.rpm\ndovecot-devel-2.0.9-5.el6.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/dovecot-2.0.9-5.el6.src.rpm\n\ni386:\ndovecot-2.0.9-5.el6.i686.rpm\ndovecot-debuginfo-2.0.9-5.el6.i686.rpm\ndovecot-mysql-2.0.9-5.el6.i686.rpm\ndovecot-pgsql-2.0.9-5.el6.i686.rpm\ndovecot-pigeonhole-2.0.9-5.el6.i686.rpm\n\nx86_64:\ndovecot-2.0.9-5.el6.i686.rpm\ndovecot-2.0.9-5.el6.x86_64.rpm\ndovecot-debuginfo-2.0.9-5.el6.i686.rpm\ndovecot-debuginfo-2.0.9-5.el6.x86_64.rpm\ndovecot-mysql-2.0.9-5.el6.x86_64.rpm\ndovecot-pgsql-2.0.9-5.el6.x86_64.rpm\ndovecot-pigeonhole-2.0.9-5.el6.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/dovecot-2.0.9-5.el6.src.rpm\n\ni386:\ndovecot-debuginfo-2.0.9-5.el6.i686.rpm\ndovecot-devel-2.0.9-5.el6.i686.rpm\n\nx86_64:\ndovecot-debuginfo-2.0.9-5.el6.x86_64.rpm\ndovecot-devel-2.0.9-5.el6.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/#package\n\n7. References:\n\nhttps://www.redhat.com/security/data/cve/CVE-2011-2166.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-2167.html\nhttps://www.redhat.com/security/data/cve/CVE-2011-4318.html\nhttps://access.redhat.com/security/updates/classification/#low\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2013 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.4 (GNU/Linux)\n\niD8DBQFRJcMBXlSAg2UNWIIRAsLkAKCVzudrg6y2jNbVu8TARQH65FPliACgpPzA\n3cvEfHEUoK/fdUBZNDEuZqU=\n=9rAE\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201110-04\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: High\n Title: Dovecot: Multiple vulnerabilities\n Date: October 10, 2011\n Bugs: #286844, #293954, #314533, #368653\n ID: 201110-04\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities were found in Dovecot, the worst of which\nallowing for remote execution of arbitrary code. Please review\nthe CVE identifiers referenced below for details. \n\nImpact\n======\n\nA remote attacker could exploit these vulnerabilities to cause the\nremote execution of arbitrary code, or a Denial of Service condition,\nto conduct directory traversal attacks, corrupt data, or disclose\ninformation. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Dovecot 1 users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=net-mail/dovecot-1.2.17\"\n\nAll Dovecot 2 users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=net-mail/dovecot-2.0.13\"\n\nNOTE: This is a legacy GLSA. Updates for all affected architectures are\navailable since May 28, 2011. It is likely that your system is already\nno longer affected by this issue. \n\nReferences\n==========\n\n[ 1 ] CVE-2009-3235\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3235\n[ 2 ] CVE-2009-3897\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3897\n[ 3 ] CVE-2010-0745\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0745\n[ 4 ] CVE-2010-3304\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3304\n[ 5 ] CVE-2010-3706\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3706\n[ 6 ] CVE-2010-3707\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3707\n[ 7 ] CVE-2010-3779\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3779\n[ 8 ] CVE-2010-3780\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3780\n[ 9 ] CVE-2011-1929\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1929\n[ 10 ] CVE-2011-2166\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2166\n[ 11 ] CVE-2011-2167\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2167\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201110-04.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2011 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-2167"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004654"
},
{
"db": "CNVD",
"id": "CNVD-2011-2129"
},
{
"db": "BID",
"id": "48003"
},
{
"db": "PACKETSTORM",
"id": "120446"
},
{
"db": "PACKETSTORM",
"id": "105652"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-2167",
"trust": 3.5
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2011/05/18/4",
"trust": 1.6
},
{
"db": "BID",
"id": "48003",
"trust": 1.3
},
{
"db": "SECUNIA",
"id": "52311",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004654",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2011-2129",
"trust": 0.6
},
{
"db": "MLIST",
"id": "[DOVECOT] 20110511 V2.0.13 RELEASED",
"trust": 0.6
},
{
"db": "MLIST",
"id": "[OSS-SECURITY] 20110518 DOVECOT RELEASES",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201105-252",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "120446",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "105652",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2129"
},
{
"db": "BID",
"id": "48003"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004654"
},
{
"db": "PACKETSTORM",
"id": "120446"
},
{
"db": "PACKETSTORM",
"id": "105652"
},
{
"db": "NVD",
"id": "CVE-2011-2167"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-252"
}
]
},
"id": "VAR-201105-0290",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2129"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2129"
}
]
},
"last_update_date": "2023-12-18T10:58:27.827000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "NEWS-2.0",
"trust": 0.8,
"url": "http://www.dovecot.org/doc/news-2.0"
},
{
"title": "Dovecot directory traversal vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/4009"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2129"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004654"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-22",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-004654"
},
{
"db": "NVD",
"id": "CVE-2011-2167"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://dovecot.org/pipermail/dovecot/2011-may/059085.html"
},
{
"trust": 1.6,
"url": "http://openwall.com/lists/oss-security/2011/05/18/4"
},
{
"trust": 1.6,
"url": "http://www.dovecot.org/doc/news-2.0"
},
{
"trust": 1.1,
"url": "http://rhn.redhat.com/errata/rhsa-2013-0520.html"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/52311"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/bid/48003"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/67674"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2167"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-2167"
},
{
"trust": 0.3,
"url": "http://www.dovecot.org/"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2166"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-4318.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-2166.html"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/security/data/cve/cve-2011-2167.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/key/#package"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4318"
},
{
"trust": 0.1,
"url": "http://bugzilla.redhat.com/):"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2167"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/knowledge/articles/11258"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-1929"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3304"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3706"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-0745"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-3897"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3779"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-2167"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3707"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-3897"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3780"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-2166"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-3235"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/glsa/glsa-201110-04.xml"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-3235"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-2129"
},
{
"db": "BID",
"id": "48003"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004654"
},
{
"db": "PACKETSTORM",
"id": "120446"
},
{
"db": "PACKETSTORM",
"id": "105652"
},
{
"db": "NVD",
"id": "CVE-2011-2167"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-252"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2011-2129"
},
{
"db": "BID",
"id": "48003"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004654"
},
{
"db": "PACKETSTORM",
"id": "120446"
},
{
"db": "PACKETSTORM",
"id": "105652"
},
{
"db": "NVD",
"id": "CVE-2011-2167"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-252"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-06-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-2129"
},
{
"date": "2011-05-26T00:00:00",
"db": "BID",
"id": "48003"
},
{
"date": "2012-03-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-004654"
},
{
"date": "2013-02-21T16:28:44",
"db": "PACKETSTORM",
"id": "120446"
},
{
"date": "2011-10-10T22:42:12",
"db": "PACKETSTORM",
"id": "105652"
},
{
"date": "2011-05-24T23:55:04.480000",
"db": "NVD",
"id": "CVE-2011-2167"
},
{
"date": "2011-05-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201105-252"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-06-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-2129"
},
{
"date": "2013-03-11T06:54:00",
"db": "BID",
"id": "48003"
},
{
"date": "2012-03-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-004654"
},
{
"date": "2017-08-29T01:29:19.253000",
"db": "NVD",
"id": "CVE-2011-2167"
},
{
"date": "2011-05-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201105-252"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "120446"
},
{
"db": "PACKETSTORM",
"id": "105652"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-252"
}
],
"trust": 0.8
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dovecot of script-login Vulnerable to performing a direct traversal attack",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-004654"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "path traversal",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201105-252"
}
],
"trust": 0.6
}
}
FKIE_CVE-2022-30550
Vulnerability from fkie_nvd - Published: 2022-07-17 19:15 - Updated: 2025-05-23 16:43
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | https://dovecot.org/security | Vendor Advisory | |
| cve@mitre.org | https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html | Mailing List, Third Party Advisory | |
| cve@mitre.org | https://security.gentoo.org/glsa/202310-19 | Third Party Advisory | |
| cve@mitre.org | https://www.dovecot.org/download/ | Product | |
| cve@mitre.org | https://www.openwall.com/lists/oss-security/2022/07/08/1 | Mailing List, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://dovecot.org/security | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/202310-19 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.dovecot.org/download/ | Product | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.openwall.com/lists/oss-security/2022/07/08/1 | Mailing List, Patch, Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7F00326-2087-4836-8421-EF182F09517A",
"versionEndExcluding": "2.4.0",
"versionStartIncluding": "2.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dovecot:dovecot:2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C2580849-4977-4475-9E1F-CFFA52793E36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user."
},
{
"lang": "es",
"value": "Se ha detectado un problema en el componente auth en Dovecot versiones 2.2 y 2.3 anteriores a 2.3.20. Cuando se presentan dos entradas de configuraci\u00f3n de passdb con los mismos ajustes de driver y args, pueden aplicarse ajustes incorrectos de username_filter y mechanism a las definiciones de passdb. Estos ajustes aplicados incorrectamente pueden conllevar a una configuraci\u00f3n de seguridad no deseada y pueden permitir una escalada de privilegios en determinadas configuraciones. La documentaci\u00f3n no aconseja contra el uso de definiciones de passdb que tengan la misma configuraci\u00f3n de driver y args. Una de estas configuraciones ser\u00eda cuando un administrador desea usar la misma configuraci\u00f3n PAM o archivo passwd para los usuarios normales y maestros, pero usa la configuraci\u00f3n username_filter para restringir cu\u00e1l de los usuarios puede ser un usuario maestro"
}
],
"id": "CVE-2022-30550",
"lastModified": "2025-05-23T16:43:11.880",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2022-07-17T19:15:18.540",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://dovecot.org/security"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202310-19"
},
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "https://www.dovecot.org/download/"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2022/07/08/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://dovecot.org/security"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202310-19"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "https://www.dovecot.org/download/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2022/07/08/1"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-33515
Vulnerability from fkie_nvd - Published: 2021-06-28 13:15 - Updated: 2024-11-21 06:08
Severity ?
Summary
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dovecot | dovecot | * | |
| fedoraproject | fedora | 33 | |
| fedoraproject | fedora | 34 | |
| debian | debian_linux | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3B8465A8-D59A-40D7-9422-DF558C428871",
"versionEndExcluding": "2.3.14.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address."
},
{
"lang": "es",
"value": "El servicio de env\u00edo en Dovecot versiones anteriores a 2.3.15, permite la inyecci\u00f3n de comandos STARTTLS en lib-smtp. La informaci\u00f3n confidencial puede ser redirigida a una direcci\u00f3n controlada por el atacante"
}
],
"id": "CVE-2021-33515",
"lastModified": "2024-11-21T06:08:59.917",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 2.5,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-28T13:15:20.960",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://dovecot.org/security"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202107-41"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://dovecot.org/security"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202107-41"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/2"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2020-28200
Vulnerability from fkie_nvd - Published: 2021-06-28 13:15 - Updated: 2024-11-21 05:22
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Summary
The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dovecot | dovecot | * | |
| fedoraproject | fedora | 33 | |
| fedoraproject | fedora | 34 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CE875870-7D70-4401-88CC-DF237054A78C",
"versionEndExcluding": "2.3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension."
},
{
"lang": "es",
"value": "El motor Sieve en Dovecot versiones anteriores a 2.3.15, permite un Consumo No controlado de Recursos, como es demostrado por una situaci\u00f3n con una expresi\u00f3n regular compleja para la extensi\u00f3n regex"
}
],
"id": "CVE-2020-28200",
"lastModified": "2024-11-21T05:22:28.117",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-28T13:15:12.357",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://dovecot.org/security"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://dovecot.org/security"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/3"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-29157
Vulnerability from fkie_nvd - Published: 2021-06-28 12:15 - Updated: 2024-11-21 06:00
Severity ?
7.5 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dovecot | dovecot | * | |
| fedoraproject | fedora | 33 | |
| fedoraproject | fedora | 34 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8FF0234A-F902-4B8D-8453-C3D3B24F9C5B",
"versionEndExcluding": "2.3.14.1",
"versionStartIncluding": "2.3.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver."
},
{
"lang": "es",
"value": "Dovecot versiones anteriores a 2.3.15, permite un Salto de Ruta ../. Un atacante con acceso al sistema de archivos local puede enga\u00f1ar a la autenticaci\u00f3n OAuth2 en usar una clave de comprobaci\u00f3n HS256 desde una ubicaci\u00f3n controlada por el atacante. Esto ocurre durante el uso de la comprobaci\u00f3n JWT local con el controlador posix fs"
}
],
"id": "CVE-2021-29157",
"lastModified": "2024-11-21T06:00:48.187",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.1,
"impactScore": 5.8,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-28T12:15:08.647",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://dovecot.org/security"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202107-41"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://dovecot.org/security"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202107-41"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/1"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2020-24386
Vulnerability from fkie_nvd - Published: 2021-01-04 17:15 - Updated: 2024-11-21 05:14
Severity ?
Summary
An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dovecot | dovecot | * | |
| debian | debian_linux | 10.0 | |
| fedoraproject | fedora | 32 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1E8AA2ED-9604-4BC7-8A46-E772A6F1D595",
"versionEndExcluding": "2.3.13",
"versionStartIncluding": "2.2.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users\u0027 email messages (and path disclosure)."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en Dovecot versiones anteriores a 2.3.13.\u0026#xa0;Al usar IMAP IDLE, un atacante autenticado puede desencadenar la inhibici\u00f3n por medio de par\u00e1metros controlados por el atacante, conllevando a un acceso a los mensajes de correo electr\u00f3nico de otros usuarios (y a una divulgaci\u00f3n de ruta)."
}
],
"id": "CVE-2020-24386",
"lastModified": "2024-11-21T05:14:43.127",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-04T17:15:13.867",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/160842/Dovecot-2.3.11.3-Access-Bypass.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/4"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://doc.dovecot.org/configuration_manual/hibernation/"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://dovecot.org/security"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202101-01"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4825"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/160842/Dovecot-2.3.11.3-Access-Bypass.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://doc.dovecot.org/configuration_manual/hibernation/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://dovecot.org/security"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202101-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4825"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2020-25275
Vulnerability from fkie_nvd - Published: 2021-01-04 17:15 - Updated: 2024-11-21 05:17
Severity ?
Summary
Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dovecot | dovecot | * | |
| debian | debian_linux | 10.0 | |
| fedoraproject | fedora | 32 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE38F95F-06DD-4637-90B3-44ED99AE668D",
"versionEndExcluding": "2.3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts."
},
{
"lang": "es",
"value": "Dovecot versiones anteriores a 2.3.13, presenta una Comprobaci\u00f3n de Entrada Inapropiada en lda, lmtp e imap, conllevando a un bloqueo de la aplicaci\u00f3n por medio de un mensaje de correo electr\u00f3nico dise\u00f1ado con determinadas opciones para diez mil partes MIME."
}
],
"id": "CVE-2020-25275",
"lastModified": "2024-11-21T05:17:50.103",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-01-04T17:15:13.930",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/160841/Dovecot-2.3.11.3-Denial-Of-Service.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/3"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://dovecot.org/security"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202101-01"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4825"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/160841/Dovecot-2.3.11.3-Denial-Of-Service.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://dovecot.org/security"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202101-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4825"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2020-12674
Vulnerability from fkie_nvd - Published: 2020-08-12 16:15 - Updated: 2024-11-21 05:00
Severity ?
Summary
In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dovecot | dovecot | * | |
| debian | debian_linux | 9.0 | |
| debian | debian_linux | 10.0 | |
| canonical | ubuntu_linux | 14.04 | |
| canonical | ubuntu_linux | 16.04 | |
| canonical | ubuntu_linux | 18.04 | |
| canonical | ubuntu_linux | 20.04 | |
| fedoraproject | fedora | 31 | |
| fedoraproject | fedora | 32 | |
| fedoraproject | fedora | 33 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
"matchCriteriaId": "346B659D-F8B1-43E5-A50E-2FC6ED1F6536",
"versionEndExcluding": "2.3.11.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
"matchCriteriaId": "815D70A8-47D3-459C-A32C-9FEACA0659D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled."
},
{
"lang": "es",
"value": "En Dovecot versiones anteriores a 2.3.11.3, el env\u00edo de una petici\u00f3n RPA con un formato especial bloquear\u00e1 el servicio auth porque una longitud de cero es manejada inapropiadamente"
}
],
"id": "CVE-2020-12674",
"lastModified": "2024-11-21T05:00:02.833",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-08-12T16:15:11.900",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00048.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00059.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://dovecot.org/security"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00024.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4AAX2MJEULPVSRZOBX3PNPFSYP4FM4TT/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYZU6CHA3VMYYAUCMHSCCQKJEVEIKPQ2/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XKKAL3OMG76ZZ7CIEMQP2K6KCTD2RAKE/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202009-02"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4456-1/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4456-2/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4745"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2020/08/12/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00048.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00059.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://dovecot.org/security"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00024.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4AAX2MJEULPVSRZOBX3PNPFSYP4FM4TT/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYZU6CHA3VMYYAUCMHSCCQKJEVEIKPQ2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XKKAL3OMG76ZZ7CIEMQP2K6KCTD2RAKE/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202009-02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4456-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4456-2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4745"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2020/08/12/3"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2020-12100
Vulnerability from fkie_nvd - Published: 2020-08-12 16:15 - Updated: 2024-11-21 04:59
Severity ?
Summary
In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME parts.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dovecot | dovecot | * | |
| debian | debian_linux | 9.0 | |
| debian | debian_linux | 10.0 | |
| fedoraproject | fedora | 31 | |
| fedoraproject | fedora | 32 | |
| fedoraproject | fedora | 33 | |
| canonical | ubuntu_linux | 14.04 | |
| canonical | ubuntu_linux | 16.04 | |
| canonical | ubuntu_linux | 18.04 | |
| canonical | ubuntu_linux | 20.04 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
"matchCriteriaId": "346B659D-F8B1-43E5-A50E-2FC6ED1F6536",
"versionEndExcluding": "2.3.11.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
"matchCriteriaId": "815D70A8-47D3-459C-A32C-9FEACA0659D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
"matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME parts."
},
{
"lang": "es",
"value": "En Dovecot versiones anteriores a 2.3.11.3, la recursividad no controlada en submission, lmtp, y lda permite a atacantes remotos causar una denegaci\u00f3n de servicio (consumo de recursos) por medio de un mensaje de correo electr\u00f3nico dise\u00f1ado con partes MIME profundamente anidadas"
}
],
"id": "CVE-2020-12100",
"lastModified": "2024-11-21T04:59:14.610",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-08-12T16:15:11.760",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2020/08/12/1"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/3"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://dovecot.org/security"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00024.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4AAX2MJEULPVSRZOBX3PNPFSYP4FM4TT/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYZU6CHA3VMYYAUCMHSCCQKJEVEIKPQ2/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XKKAL3OMG76ZZ7CIEMQP2K6KCTD2RAKE/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202009-02"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4456-1/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4456-2/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4745"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2020/08/12/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://dovecot.org/security"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00024.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4AAX2MJEULPVSRZOBX3PNPFSYP4FM4TT/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYZU6CHA3VMYYAUCMHSCCQKJEVEIKPQ2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XKKAL3OMG76ZZ7CIEMQP2K6KCTD2RAKE/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202009-02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4456-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4456-2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4745"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-674"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2022-30550 (GCVE-0-2022-30550)
Vulnerability from cvelistv5 – Published: 2022-07-17 00:00 – Updated: 2024-10-15 18:35
VLAI?
Summary
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
Severity ?
8.8 (High)
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:48:36.356Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.dovecot.org/download/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.openwall.com/lists/oss-security/2022/07/08/1"
},
{
"name": "[debian-lts-announce] 20220927 [SECURITY] [DLA 3122-1] dovecot security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html"
},
{
"name": "GLSA-202310-19",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202310-19"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2022-30550",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-15T17:16:02.736424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-15T18:35:00.129Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-30T11:06:19.441543",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://dovecot.org/security"
},
{
"url": "https://www.dovecot.org/download/"
},
{
"url": "https://www.openwall.com/lists/oss-security/2022/07/08/1"
},
{
"name": "[debian-lts-announce] 20220927 [SECURITY] [DLA 3122-1] dovecot security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html"
},
{
"name": "GLSA-202310-19",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202310-19"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-30550",
"datePublished": "2022-07-17T00:00:00",
"dateReserved": "2022-05-11T00:00:00",
"dateUpdated": "2024-10-15T18:35:00.129Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-28200 (GCVE-0-2020-28200)
Vulnerability from cvelistv5 – Published: 2021-06-28 12:08 – Updated: 2024-08-04 16:33
VLAI?
Summary
The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension.
Severity ?
4.3 (Medium)
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T16:33:58.153Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/3"
},
{
"name": "FEDORA-2021-208340a217",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:L/S:U/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-05T02:06:26",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/3"
},
{
"name": "FEDORA-2021-208340a217",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-28200",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:L/S:U/UI:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://dovecot.org/security",
"refsource": "MISC",
"url": "https://dovecot.org/security"
},
{
"name": "https://www.openwall.com/lists/oss-security/2021/06/28/3",
"refsource": "CONFIRM",
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/3"
},
{
"name": "FEDORA-2021-208340a217",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-28200",
"datePublished": "2021-06-28T12:08:46",
"dateReserved": "2020-11-04T00:00:00",
"dateUpdated": "2024-08-04T16:33:58.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-33515 (GCVE-0-2021-33515)
Vulnerability from cvelistv5 – Published: 2021-06-28 12:04 – Updated: 2024-08-03 23:50
VLAI?
Summary
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:42.988Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/2"
},
{
"name": "FEDORA-2021-208340a217",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"name": "GLSA-202107-41",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202107-41"
},
{
"name": "[debian-lts-announce] 20220927 [SECURITY] [DLA 3122-1] dovecot security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-27T05:06:17",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/2"
},
{
"name": "FEDORA-2021-208340a217",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"name": "GLSA-202107-41",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202107-41"
},
{
"name": "[debian-lts-announce] 20220927 [SECURITY] [DLA 3122-1] dovecot security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33515",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://dovecot.org/security",
"refsource": "MISC",
"url": "https://dovecot.org/security"
},
{
"name": "https://www.openwall.com/lists/oss-security/2021/06/28/2",
"refsource": "CONFIRM",
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/2"
},
{
"name": "FEDORA-2021-208340a217",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"name": "GLSA-202107-41",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202107-41"
},
{
"name": "[debian-lts-announce] 20220927 [SECURITY] [DLA 3122-1] dovecot security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33515",
"datePublished": "2021-06-28T12:04:59",
"dateReserved": "2021-05-24T00:00:00",
"dateUpdated": "2024-08-03T23:50:42.988Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-29157 (GCVE-0-2021-29157)
Vulnerability from cvelistv5 – Published: 2021-06-28 11:58 – Updated: 2024-08-03 22:02
VLAI?
Summary
Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.
Severity ?
7.5 (High)
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:02:51.122Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/1"
},
{
"name": "FEDORA-2021-208340a217",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"name": "GLSA-202107-41",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202107-41"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:H/AV:L/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-18T05:06:18",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/1"
},
{
"name": "FEDORA-2021-208340a217",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"name": "GLSA-202107-41",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202107-41"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-29157",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:H/AV:L/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://dovecot.org/security",
"refsource": "MISC",
"url": "https://dovecot.org/security"
},
{
"name": "https://www.openwall.com/lists/oss-security/2021/06/28/1",
"refsource": "CONFIRM",
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/1"
},
{
"name": "FEDORA-2021-208340a217",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"name": "GLSA-202107-41",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202107-41"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-29157",
"datePublished": "2021-06-28T11:58:41",
"dateReserved": "2021-03-25T00:00:00",
"dateUpdated": "2024-08-03T22:02:51.122Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-24386 (GCVE-0-2020-24386)
Vulnerability from cvelistv5 – Published: 2021-01-04 16:25 – Updated: 2024-08-04 15:12
VLAI?
Summary
An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:12:08.740Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://doc.dovecot.org/configuration_manual/hibernation/"
},
{
"name": "DSA-4825",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4825"
},
{
"name": "20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/160842/Dovecot-2.3.11.3-Access-Bypass.html"
},
{
"name": "GLSA-202101-01",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202101-01"
},
{
"name": "FEDORA-2021-c90cb486f7",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users\u0027 email messages (and path disclosure)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T02:06:06",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://doc.dovecot.org/configuration_manual/hibernation/"
},
{
"name": "DSA-4825",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2021/dsa-4825"
},
{
"name": "20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/160842/Dovecot-2.3.11.3-Access-Bypass.html"
},
{
"name": "GLSA-202101-01",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202101-01"
},
{
"name": "FEDORA-2021-c90cb486f7",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/"
}
],
"x_ConverterErrors": {
"cvssV3_1": {
"error": "CVSSV3_1 data from v4 record is invalid",
"message": "Missing mandatory metrics \"AV\""
}
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-24386",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users\u0027 email messages (and path disclosure)."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"availabilityImpact": "NONE",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:H/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://dovecot.org/security",
"refsource": "MISC",
"url": "https://dovecot.org/security"
},
{
"name": "http://www.openwall.com/lists/oss-security/2021/01/04/4",
"refsource": "CONFIRM",
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/4"
},
{
"name": "https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html",
"refsource": "CONFIRM",
"url": "https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html"
},
{
"name": "https://doc.dovecot.org/configuration_manual/hibernation/",
"refsource": "MISC",
"url": "https://doc.dovecot.org/configuration_manual/hibernation/"
},
{
"name": "DSA-4825",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2021/dsa-4825"
},
{
"name": "20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"name": "http://packetstormsecurity.com/files/160842/Dovecot-2.3.11.3-Access-Bypass.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/160842/Dovecot-2.3.11.3-Access-Bypass.html"
},
{
"name": "GLSA-202101-01",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202101-01"
},
{
"name": "FEDORA-2021-c90cb486f7",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-24386",
"datePublished": "2021-01-04T16:25:43",
"dateReserved": "2020-08-19T00:00:00",
"dateUpdated": "2024-08-04T15:12:08.740Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25275 (GCVE-0-2020-25275)
Vulnerability from cvelistv5 – Published: 2021-01-04 16:19 – Updated: 2024-08-04 15:33
VLAI?
Summary
Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:33:05.386Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html"
},
{
"name": "DSA-4825",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4825"
},
{
"name": "20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/160841/Dovecot-2.3.11.3-Denial-Of-Service.html"
},
{
"name": "GLSA-202101-01",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202101-01"
},
{
"name": "FEDORA-2021-c90cb486f7",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T02:06:07",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html"
},
{
"name": "DSA-4825",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2021/dsa-4825"
},
{
"name": "20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/160841/Dovecot-2.3.11.3-Denial-Of-Service.html"
},
{
"name": "GLSA-202101-01",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202101-01"
},
{
"name": "FEDORA-2021-c90cb486f7",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-25275",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://dovecot.org/security",
"refsource": "MISC",
"url": "https://dovecot.org/security"
},
{
"name": "http://www.openwall.com/lists/oss-security/2021/01/04/3",
"refsource": "CONFIRM",
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/3"
},
{
"name": "https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html",
"refsource": "CONFIRM",
"url": "https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html"
},
{
"name": "DSA-4825",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2021/dsa-4825"
},
{
"name": "20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"name": "http://packetstormsecurity.com/files/160841/Dovecot-2.3.11.3-Denial-Of-Service.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/160841/Dovecot-2.3.11.3-Denial-Of-Service.html"
},
{
"name": "GLSA-202101-01",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202101-01"
},
{
"name": "FEDORA-2021-c90cb486f7",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-25275",
"datePublished": "2021-01-04T16:19:08",
"dateReserved": "2020-09-11T00:00:00",
"dateUpdated": "2024-08-04T15:33:05.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-30550 (GCVE-0-2022-30550)
Vulnerability from nvd – Published: 2022-07-17 00:00 – Updated: 2024-10-15 18:35
VLAI?
Summary
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
Severity ?
8.8 (High)
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:48:36.356Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.dovecot.org/download/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.openwall.com/lists/oss-security/2022/07/08/1"
},
{
"name": "[debian-lts-announce] 20220927 [SECURITY] [DLA 3122-1] dovecot security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html"
},
{
"name": "GLSA-202310-19",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202310-19"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2022-30550",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-15T17:16:02.736424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-15T18:35:00.129Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-30T11:06:19.441543",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://dovecot.org/security"
},
{
"url": "https://www.dovecot.org/download/"
},
{
"url": "https://www.openwall.com/lists/oss-security/2022/07/08/1"
},
{
"name": "[debian-lts-announce] 20220927 [SECURITY] [DLA 3122-1] dovecot security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html"
},
{
"name": "GLSA-202310-19",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202310-19"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-30550",
"datePublished": "2022-07-17T00:00:00",
"dateReserved": "2022-05-11T00:00:00",
"dateUpdated": "2024-10-15T18:35:00.129Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-28200 (GCVE-0-2020-28200)
Vulnerability from nvd – Published: 2021-06-28 12:08 – Updated: 2024-08-04 16:33
VLAI?
Summary
The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension.
Severity ?
4.3 (Medium)
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T16:33:58.153Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/3"
},
{
"name": "FEDORA-2021-208340a217",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:L/S:U/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-05T02:06:26",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/3"
},
{
"name": "FEDORA-2021-208340a217",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-28200",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:L/S:U/UI:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://dovecot.org/security",
"refsource": "MISC",
"url": "https://dovecot.org/security"
},
{
"name": "https://www.openwall.com/lists/oss-security/2021/06/28/3",
"refsource": "CONFIRM",
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/3"
},
{
"name": "FEDORA-2021-208340a217",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-28200",
"datePublished": "2021-06-28T12:08:46",
"dateReserved": "2020-11-04T00:00:00",
"dateUpdated": "2024-08-04T16:33:58.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-33515 (GCVE-0-2021-33515)
Vulnerability from nvd – Published: 2021-06-28 12:04 – Updated: 2024-08-03 23:50
VLAI?
Summary
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:42.988Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/2"
},
{
"name": "FEDORA-2021-208340a217",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"name": "GLSA-202107-41",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202107-41"
},
{
"name": "[debian-lts-announce] 20220927 [SECURITY] [DLA 3122-1] dovecot security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-27T05:06:17",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/2"
},
{
"name": "FEDORA-2021-208340a217",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"name": "GLSA-202107-41",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202107-41"
},
{
"name": "[debian-lts-announce] 20220927 [SECURITY] [DLA 3122-1] dovecot security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33515",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://dovecot.org/security",
"refsource": "MISC",
"url": "https://dovecot.org/security"
},
{
"name": "https://www.openwall.com/lists/oss-security/2021/06/28/2",
"refsource": "CONFIRM",
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/2"
},
{
"name": "FEDORA-2021-208340a217",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"name": "GLSA-202107-41",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202107-41"
},
{
"name": "[debian-lts-announce] 20220927 [SECURITY] [DLA 3122-1] dovecot security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33515",
"datePublished": "2021-06-28T12:04:59",
"dateReserved": "2021-05-24T00:00:00",
"dateUpdated": "2024-08-03T23:50:42.988Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-29157 (GCVE-0-2021-29157)
Vulnerability from nvd – Published: 2021-06-28 11:58 – Updated: 2024-08-03 22:02
VLAI?
Summary
Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.
Severity ?
7.5 (High)
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:02:51.122Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/1"
},
{
"name": "FEDORA-2021-208340a217",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"name": "GLSA-202107-41",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202107-41"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:H/AV:L/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-18T05:06:18",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/1"
},
{
"name": "FEDORA-2021-208340a217",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"name": "GLSA-202107-41",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202107-41"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-29157",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:H/AV:L/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://dovecot.org/security",
"refsource": "MISC",
"url": "https://dovecot.org/security"
},
{
"name": "https://www.openwall.com/lists/oss-security/2021/06/28/1",
"refsource": "CONFIRM",
"url": "https://www.openwall.com/lists/oss-security/2021/06/28/1"
},
{
"name": "FEDORA-2021-208340a217",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/"
},
{
"name": "FEDORA-2021-891c1ab1ac",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/"
},
{
"name": "GLSA-202107-41",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202107-41"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-29157",
"datePublished": "2021-06-28T11:58:41",
"dateReserved": "2021-03-25T00:00:00",
"dateUpdated": "2024-08-03T22:02:51.122Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-24386 (GCVE-0-2020-24386)
Vulnerability from nvd – Published: 2021-01-04 16:25 – Updated: 2024-08-04 15:12
VLAI?
Summary
An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:12:08.740Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://doc.dovecot.org/configuration_manual/hibernation/"
},
{
"name": "DSA-4825",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4825"
},
{
"name": "20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/160842/Dovecot-2.3.11.3-Access-Bypass.html"
},
{
"name": "GLSA-202101-01",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202101-01"
},
{
"name": "FEDORA-2021-c90cb486f7",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users\u0027 email messages (and path disclosure)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T02:06:06",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://doc.dovecot.org/configuration_manual/hibernation/"
},
{
"name": "DSA-4825",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2021/dsa-4825"
},
{
"name": "20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/160842/Dovecot-2.3.11.3-Access-Bypass.html"
},
{
"name": "GLSA-202101-01",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202101-01"
},
{
"name": "FEDORA-2021-c90cb486f7",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/"
}
],
"x_ConverterErrors": {
"cvssV3_1": {
"error": "CVSSV3_1 data from v4 record is invalid",
"message": "Missing mandatory metrics \"AV\""
}
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-24386",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users\u0027 email messages (and path disclosure)."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"availabilityImpact": "NONE",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:H/A:N/C:H/I:H/PR:L/S:C/UI:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://dovecot.org/security",
"refsource": "MISC",
"url": "https://dovecot.org/security"
},
{
"name": "http://www.openwall.com/lists/oss-security/2021/01/04/4",
"refsource": "CONFIRM",
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/4"
},
{
"name": "https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html",
"refsource": "CONFIRM",
"url": "https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html"
},
{
"name": "https://doc.dovecot.org/configuration_manual/hibernation/",
"refsource": "MISC",
"url": "https://doc.dovecot.org/configuration_manual/hibernation/"
},
{
"name": "DSA-4825",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2021/dsa-4825"
},
{
"name": "20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"name": "http://packetstormsecurity.com/files/160842/Dovecot-2.3.11.3-Access-Bypass.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/160842/Dovecot-2.3.11.3-Access-Bypass.html"
},
{
"name": "GLSA-202101-01",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202101-01"
},
{
"name": "FEDORA-2021-c90cb486f7",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-24386",
"datePublished": "2021-01-04T16:25:43",
"dateReserved": "2020-08-19T00:00:00",
"dateUpdated": "2024-08-04T15:12:08.740Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25275 (GCVE-0-2020-25275)
Vulnerability from nvd – Published: 2021-01-04 16:19 – Updated: 2024-08-04 15:33
VLAI?
Summary
Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:33:05.386Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html"
},
{
"name": "DSA-4825",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4825"
},
{
"name": "20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/160841/Dovecot-2.3.11.3-Denial-Of-Service.html"
},
{
"name": "GLSA-202101-01",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202101-01"
},
{
"name": "FEDORA-2021-c90cb486f7",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-20T02:06:07",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://dovecot.org/security"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html"
},
{
"name": "DSA-4825",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2021/dsa-4825"
},
{
"name": "20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/160841/Dovecot-2.3.11.3-Denial-Of-Service.html"
},
{
"name": "GLSA-202101-01",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202101-01"
},
{
"name": "FEDORA-2021-c90cb486f7",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-25275",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://dovecot.org/security",
"refsource": "MISC",
"url": "https://dovecot.org/security"
},
{
"name": "http://www.openwall.com/lists/oss-security/2021/01/04/3",
"refsource": "CONFIRM",
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/3"
},
{
"name": "https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html",
"refsource": "CONFIRM",
"url": "https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html"
},
{
"name": "DSA-4825",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2021/dsa-4825"
},
{
"name": "20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"name": "http://packetstormsecurity.com/files/160841/Dovecot-2.3.11.3-Denial-Of-Service.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/160841/Dovecot-2.3.11.3-Denial-Of-Service.html"
},
{
"name": "GLSA-202101-01",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202101-01"
},
{
"name": "FEDORA-2021-c90cb486f7",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-25275",
"datePublished": "2021-01-04T16:19:08",
"dateReserved": "2020-09-11T00:00:00",
"dateUpdated": "2024-08-04T15:33:05.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}