Bug 1187418 (CVE-2021-29157)

Summary:	VUL-0: CVE-2021-29157: dovecot,dovecot22,dovecot23: Local attacker can login as any user and access their emails
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Gianluca Gabrielli <gianluca.gabrielli>
Component:	Incidents	Assignee:	Peter Varkoly <varkoly>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	cathy.hu, rfrohl, varkoly
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/302375/ https://jira.suse.com/browse/TEAM-4317
Whiteboard:	CVSSv3.1:SUSE:CVE-2021-29157:6.7:(AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Attachments:	Upstream patch Upstream patch v2

Description Gianluca Gabrielli 2021-06-16 13:37:32 UTC

via distros.

Open-Xchange Security Advisory 2021-06-21

Product: Dovecot
Vendor: OX Software GmbH
Internal reference: DOV-4476 (Bug ID)
Vulnerability type: CWE-24: Path Traversal: '../filedir'
Vulnerable version: 2.3.11-2.3.14
Vulnerable component: imap, pop3, submission, managesieve
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 2.3.14.1
Vendor notification: 2021-03-22
Solution date: 2021-04-14
Public disclosure: 2021-06-21
CVE reference: CVE-2021-29157
CVSS: 6.7 (CVSS3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Researcher credit: Kirin of Tencent Security Xuanwu Lab

Vulnerability Details:

Dovecot does not correctly escape kid and azp fields in JWT tokens. This
may be used to supply attacker controlled keys to validate tokens in
some configurations. This requires attacker to be able to write files to
local disk.

Risk:

Local attacker can login as any user and access their emails.

Workaround:

Disable local JWT validation in oauth2, or use a different dict driver
than fs:posix.

Solution:

Operators should update to 2.3.14.1 or later version.

Comment 3 Gianluca Gabrielli 2021-06-16 13:39:44 UTC

Created attachment 850313 [details]
Upstream patch

Comment 4 Gianluca Gabrielli 2021-06-16 15:26:09 UTC

Affected packages:
 - SUSE:SLE-15:Update/dovecot      2.3
 - SUSE:SLE-15-SP1:Update/dovecot23        2.3.11.3
 - SUSE:SLE-15-SP2:Update/dovecot23        2.3.11.3
 - SUSE:SLE-15:Update/dovecot23    2.3.11.3
 - openSUSE:Factory/dovecot23      2.3.14

Comment 5 Gianluca Gabrielli 2021-06-17 12:44:17 UTC

Created attachment 850361 [details]
Upstream patch v2

oauth2 patch updated with a minimal unit test fix.

Comment 7 Gianluca Gabrielli 2021-06-22 11:01:11 UTC

This is now public

Comment 8 Swamp Workflow Management 2021-06-22 16:23:35 UTC

SUSE-SU-2021:2122-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1187418,1187419
CVE References: CVE-2021-29157,CVE-2021-33515
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    dovecot23-2.3.11.3-4.35.1
SUSE Linux Enterprise Server 15-LTSS (src):    dovecot23-2.3.11.3-4.35.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    dovecot23-2.3.11.3-4.35.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    dovecot23-2.3.11.3-4.35.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 9 Swamp Workflow Management 2021-06-22 16:29:02 UTC

SUSE-SU-2021:2123-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1187418,1187419
CVE References: CVE-2021-29157,CVE-2021-33515
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP3 (src):    dovecot23-2.3.11.3-55.1
SUSE Linux Enterprise Module for Server Applications 15-SP2 (src):    dovecot23-2.3.11.3-55.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 10 Swamp Workflow Management 2021-06-22 16:30:29 UTC

SUSE-SU-2021:2124-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1187418,1187419
CVE References: CVE-2021-29157,CVE-2021-33515
JIRA References: 
Sources used:
SUSE Manager Server 4.0 (src):    dovecot23-2.3.11.3-24.1
SUSE Manager Retail Branch Server 4.0 (src):    dovecot23-2.3.11.3-24.1
SUSE Manager Proxy 4.0 (src):    dovecot23-2.3.11.3-24.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    dovecot23-2.3.11.3-24.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    dovecot23-2.3.11.3-24.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    dovecot23-2.3.11.3-24.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    dovecot23-2.3.11.3-24.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    dovecot23-2.3.11.3-24.1
SUSE Enterprise Storage 6 (src):    dovecot23-2.3.11.3-24.1
SUSE CaaS Platform 4.0 (src):    dovecot23-2.3.11.3-24.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 11 Swamp Workflow Management 2021-07-10 22:55:27 UTC

openSUSE-SU-2021:2123-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1187418,1187419
CVE References: CVE-2021-29157,CVE-2021-33515
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    dovecot23-2.3.11.3-55.1

Comment 12 Swamp Workflow Management 2021-08-31 22:17:07 UTC

# maintenance_jira_update_notice
SUSE-SU-2021:2890-1: An update that solves two vulnerabilities, contains one feature and has one errata is now available.

Category: security (moderate)
Bug References: 1187418,1187419,1187420
CVE References: CVE-2020-28200,CVE-2021-29157
JIRA References: SLE-19970
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    dovecot23-2.3.15-4.38.3
SUSE Linux Enterprise Server 15-LTSS (src):    dovecot23-2.3.15-4.38.3
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    dovecot23-2.3.15-4.38.3
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    dovecot23-2.3.15-4.38.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 13 Swamp Workflow Management 2021-08-31 22:20:50 UTC

# maintenance_jira_update_notice
SUSE-SU-2021:2892-1: An update that solves two vulnerabilities, contains one feature and has one errata is now available.

Category: security (moderate)
Bug References: 1187418,1187419,1187420
CVE References: CVE-2020-28200,CVE-2021-29157
JIRA References: SLE-19970
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP3 (src):    dovecot23-2.3.15-58.3
SUSE Linux Enterprise Module for Server Applications 15-SP2 (src):    dovecot23-2.3.15-58.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 14 Swamp Workflow Management 2021-08-31 22:22:20 UTC

# maintenance_jira_update_notice
SUSE-SU-2021:2891-1: An update that solves two vulnerabilities, contains one feature and has one errata is now available.

Category: security (moderate)
Bug References: 1187418,1187419,1187420
CVE References: CVE-2020-28200,CVE-2021-29157
JIRA References: SLE-19970
Sources used:
SUSE Manager Server 4.0 (src):    dovecot23-2.3.15-27.3
SUSE Manager Retail Branch Server 4.0 (src):    dovecot23-2.3.15-27.3
SUSE Manager Proxy 4.0 (src):    dovecot23-2.3.15-27.3
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    dovecot23-2.3.15-27.3
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    dovecot23-2.3.15-27.3
SUSE Linux Enterprise Server 15-SP1-BCL (src):    dovecot23-2.3.15-27.3
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    dovecot23-2.3.15-27.3
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    dovecot23-2.3.15-27.3
SUSE Enterprise Storage 6 (src):    dovecot23-2.3.15-27.3
SUSE CaaS Platform 4.0 (src):    dovecot23-2.3.15-27.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 15 Swamp Workflow Management 2021-08-31 22:24:35 UTC

# maintenance_jira_update_notice
openSUSE-SU-2021:2892-1: An update that solves two vulnerabilities, contains one feature and has one errata is now available.

Category: security (moderate)
Bug References: 1187418,1187419,1187420
CVE References: CVE-2020-28200,CVE-2021-29157
JIRA References: SLE-19970
Sources used:
openSUSE Leap 15.3 (src):    dovecot23-2.3.15-58.3

Comment 16 Swamp Workflow Management 2021-09-04 01:16:22 UTC

# maintenance_jira_update_notice
openSUSE-SU-2021:1225-1: An update that solves two vulnerabilities, contains one feature and has one errata is now available.

Category: security (moderate)
Bug References: 1187418,1187419,1187420
CVE References: CVE-2020-28200,CVE-2021-29157
JIRA References: SLE-19970
Sources used:
openSUSE Leap 15.2 (src):    dovecot23-2.3.15-lp152.2.12.1

Comment 18 Hu 2022-08-18 08:53:12 UTC

Closing, as SUSE:SLE-15:Update/dovecot only contains config, no code