First Last Prev Next    This bug is not in your last search results.
Bug 1187418 - (CVE-2021-29157) VUL-0: CVE-2021-29157: dovecot,dovecot22,dovecot23: Local attacker can login as any user and access their emails
(CVE-2021-29157)
VUL-0: CVE-2021-29157: dovecot,dovecot22,dovecot23: Local attacker can login ...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Peter Varkoly
Security Team bot
https://smash.suse.de/issue/302375/ ...
CVSSv3.1:SUSE:CVE-2021-29157:6.7:(AV:...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2021-06-16 13:37 UTC by Gianluca Gabrielli
Modified: 2022-08-18 08:53 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Upstream patch (3.51 KB, patch)
2021-06-16 13:39 UTC, Gianluca Gabrielli 		Details | Diff
Upstream patch v2 (4.10 KB, patch)
2021-06-17 12:44 UTC, Gianluca Gabrielli 		Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Gianluca Gabrielli 2021-06-16 13:37:32 UTC 
via distros.

Open-Xchange Security Advisory 2021-06-21

Product: Dovecot
Vendor: OX Software GmbH
Internal reference: DOV-4476 (Bug ID)
Vulnerability type: CWE-24: Path Traversal: '../filedir'
Vulnerable version: 2.3.11-2.3.14
Vulnerable component: imap, pop3, submission, managesieve
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 2.3.14.1
Vendor notification: 2021-03-22
Solution date: 2021-04-14
Public disclosure: 2021-06-21
CVE reference: CVE-2021-29157
CVSS: 6.7 (CVSS3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Researcher credit: Kirin of Tencent Security Xuanwu Lab

Vulnerability Details:

Dovecot does not correctly escape kid and azp fields in JWT tokens. This
may be used to supply attacker controlled keys to validate tokens in
some configurations. This requires attacker to be able to write files to
local disk.

Risk:

Local attacker can login as any user and access their emails.

Workaround:

Disable local JWT validation in oauth2, or use a different dict driver
than fs:posix.

Solution:

Operators should update to 2.3.14.1 or later version.
Comment 3 Gianluca Gabrielli 2021-06-16 13:39:44 UTC 
Created attachment 850313 [details]
Upstream patch
Comment 4 Gianluca Gabrielli 2021-06-16 15:26:09 UTC 
Affected packages:
 - SUSE:SLE-15:Update/dovecot      2.3
 - SUSE:SLE-15-SP1:Update/dovecot23        2.3.11.3
 - SUSE:SLE-15-SP2:Update/dovecot23        2.3.11.3
 - SUSE:SLE-15:Update/dovecot23    2.3.11.3
 - openSUSE:Factory/dovecot23      2.3.14
Comment 5 Gianluca Gabrielli 2021-06-17 12:44:17 UTC 
Created attachment 850361 [details]
Upstream patch v2

oauth2 patch updated with a minimal unit test fix.
Comment 7 Gianluca Gabrielli 2021-06-22 11:01:11 UTC 
This is now public
Comment 8 Swamp Workflow Management 2021-06-22 16:23:35 UTC 
SUSE-SU-2021:2122-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1187418,1187419
CVE References: CVE-2021-29157,CVE-2021-33515
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    dovecot23-2.3.11.3-4.35.1
SUSE Linux Enterprise Server 15-LTSS (src):    dovecot23-2.3.11.3-4.35.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    dovecot23-2.3.11.3-4.35.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    dovecot23-2.3.11.3-4.35.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2021-06-22 16:29:02 UTC 
SUSE-SU-2021:2123-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1187418,1187419
CVE References: CVE-2021-29157,CVE-2021-33515
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP3 (src):    dovecot23-2.3.11.3-55.1
SUSE Linux Enterprise Module for Server Applications 15-SP2 (src):    dovecot23-2.3.11.3-55.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2021-06-22 16:30:29 UTC 
SUSE-SU-2021:2124-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1187418,1187419
CVE References: CVE-2021-29157,CVE-2021-33515
JIRA References: 
Sources used:
SUSE Manager Server 4.0 (src):    dovecot23-2.3.11.3-24.1
SUSE Manager Retail Branch Server 4.0 (src):    dovecot23-2.3.11.3-24.1
SUSE Manager Proxy 4.0 (src):    dovecot23-2.3.11.3-24.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    dovecot23-2.3.11.3-24.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    dovecot23-2.3.11.3-24.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    dovecot23-2.3.11.3-24.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    dovecot23-2.3.11.3-24.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    dovecot23-2.3.11.3-24.1
SUSE Enterprise Storage 6 (src):    dovecot23-2.3.11.3-24.1
SUSE CaaS Platform 4.0 (src):    dovecot23-2.3.11.3-24.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2021-07-10 22:55:27 UTC 
openSUSE-SU-2021:2123-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1187418,1187419
CVE References: CVE-2021-29157,CVE-2021-33515
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    dovecot23-2.3.11.3-55.1
Comment 12 Swamp Workflow Management 2021-08-31 22:17:07 UTC 
# maintenance_jira_update_notice
SUSE-SU-2021:2890-1: An update that solves two vulnerabilities, contains one feature and has one errata is now available.

Category: security (moderate)
Bug References: 1187418,1187419,1187420
CVE References: CVE-2020-28200,CVE-2021-29157
JIRA References: SLE-19970
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    dovecot23-2.3.15-4.38.3
SUSE Linux Enterprise Server 15-LTSS (src):    dovecot23-2.3.15-4.38.3
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    dovecot23-2.3.15-4.38.3
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    dovecot23-2.3.15-4.38.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Swamp Workflow Management 2021-08-31 22:20:50 UTC 
# maintenance_jira_update_notice
SUSE-SU-2021:2892-1: An update that solves two vulnerabilities, contains one feature and has one errata is now available.

Category: security (moderate)
Bug References: 1187418,1187419,1187420
CVE References: CVE-2020-28200,CVE-2021-29157
JIRA References: SLE-19970
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP3 (src):    dovecot23-2.3.15-58.3
SUSE Linux Enterprise Module for Server Applications 15-SP2 (src):    dovecot23-2.3.15-58.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Swamp Workflow Management 2021-08-31 22:22:20 UTC 
# maintenance_jira_update_notice
SUSE-SU-2021:2891-1: An update that solves two vulnerabilities, contains one feature and has one errata is now available.

Category: security (moderate)
Bug References: 1187418,1187419,1187420
CVE References: CVE-2020-28200,CVE-2021-29157
JIRA References: SLE-19970
Sources used:
SUSE Manager Server 4.0 (src):    dovecot23-2.3.15-27.3
SUSE Manager Retail Branch Server 4.0 (src):    dovecot23-2.3.15-27.3
SUSE Manager Proxy 4.0 (src):    dovecot23-2.3.15-27.3
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    dovecot23-2.3.15-27.3
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    dovecot23-2.3.15-27.3
SUSE Linux Enterprise Server 15-SP1-BCL (src):    dovecot23-2.3.15-27.3
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    dovecot23-2.3.15-27.3
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    dovecot23-2.3.15-27.3
SUSE Enterprise Storage 6 (src):    dovecot23-2.3.15-27.3
SUSE CaaS Platform 4.0 (src):    dovecot23-2.3.15-27.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Swamp Workflow Management 2021-08-31 22:24:35 UTC 
# maintenance_jira_update_notice
openSUSE-SU-2021:2892-1: An update that solves two vulnerabilities, contains one feature and has one errata is now available.

Category: security (moderate)
Bug References: 1187418,1187419,1187420
CVE References: CVE-2020-28200,CVE-2021-29157
JIRA References: SLE-19970
Sources used:
openSUSE Leap 15.3 (src):    dovecot23-2.3.15-58.3
Comment 16 Swamp Workflow Management 2021-09-04 01:16:22 UTC 
# maintenance_jira_update_notice
openSUSE-SU-2021:1225-1: An update that solves two vulnerabilities, contains one feature and has one errata is now available.

Category: security (moderate)
Bug References: 1187418,1187419,1187420
CVE References: CVE-2020-28200,CVE-2021-29157
JIRA References: SLE-19970
Sources used:
openSUSE Leap 15.2 (src):    dovecot23-2.3.15-lp152.2.12.1
Comment 18 Hu 2022-08-18 08:53:12 UTC 
Closing, as SUSE:SLE-15:Update/dovecot only contains config, no code
First Last Prev Next    This bug is not in your last search results.