Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick
    OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs
    during use of local JWT validation with the posix fs driver. (CVE-2021-29157)

  - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive
    information can be redirected to an attacker-controlled address. (CVE-2021-33515)

The remote host is affected by the vulnerability described in GLSA-202107-41 (Dovecot: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Dovecot. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1225-1 advisory.

  - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a     situation with a complex regular expression for the regex extension. (CVE-2020-28200)

  - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick     OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs     during use of local JWT validation with the posix fs driver. (CVE-2021-29157)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2892-1 advisory.

  - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a     situation with a complex regular expression for the regex extension. (CVE-2020-28200)

  - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick     OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs     during use of local JWT validation with the posix fs driver. (CVE-2021-29157)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2123-1 advisory.

  - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick     OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs     during use of local JWT validation with the posix fs driver. (CVE-2021-29157)

  - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive     information can be redirected to an attacker-controlled address. (CVE-2021-33515)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2124-1 advisory.

    - CVE-2021-29157: Local attacker can login as any user and access their emails (bsc#1187418)
    - CVE-2021-33515: Attacker can potentially steal user credentials and mails (bsc#1187419)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2123-1 advisory.

    - CVE-2021-29157: Local attacker can login as any user and access their emails (bsc#1187418)
    - CVE-2021-33515: Attacker can potentially steal user credentials and mails (bsc#1187419)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2122-1 advisory.

    - CVE-2021-29157: Local attacker can login as any user and access their emails (bsc#1187418)
    - CVE-2021-33515: Attacker can potentially steal user credentials and mails (bsc#1187419)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:0920-1 advisory.

  - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick     OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs     during use of local JWT validation with the posix fs driver. (CVE-2021-29157)

  - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive     information can be redirected to an attacker-controlled address. (CVE-2021-33515)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Dovecot team reports :

CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens in some configurations. This requires attacker to be able to write files to local disk.

CVE-2021-33515: On-path attacker could inject plaintext commands before STARTTLS negotiation that would be executed after STARTTLS finished with the client. Only the SMTP submission service is affected.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4993-1 advisory.

    Kirin discovered that Dovecot incorrectly escaped kid and azp fields in JWT tokens. A local attacker could     possibly use this issue to validate tokens using arbitrary keys. This issue only affected Ubuntu 20.10 and     Ubuntu 21.04. (CVE-2021-29157)

    Fabian Ising and Damian Poddebniak discovered that Dovecot incorrectly handled STARTTLS when using the     SMTP submission service. A remote attacker could possibly use this issue to inject plaintext commands     before STARTTLS negotiation. (CVE-2021-33515)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
423869	Alpine: multiple dovecot packages: security update to 2.3.15-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
423869	Alpine: multiple dovecot packages: security update to 2.3.15-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
400196	Alpine: multiple dovecot packages: security update to 2.3.14-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
400196	Alpine: multiple dovecot packages: security update to 2.3.14-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
157022	GLSA-202107-41 : Dovecot: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
153005	openSUSE 15 Security Update : dovecot23 (openSUSE-SU-2021:1225-1)	Nessus	SuSE Local Security Checks	medium
152947	SUSE SLES15: dovecot23 / dovecot23-backend-mysql / dovecot23-backend-pgsql / etc (SUSE-SU-2021:2891-1)	Nessus	SuSE Local Security Checks	medium
152945	SUSE SLES15: dovecot23 / dovecot23-backend-mysql / dovecot23-backend-pgsql / etc (SUSE-SU-2021:2890-1)	Nessus	SuSE Local Security Checks	medium
152944	SUSE SLES15: dovecot23 / dovecot23-backend-mysql / dovecot23-backend-pgsql / etc (SUSE-SU-2021:2892-1)	Nessus	SuSE Local Security Checks	medium
152941	openSUSE 15 Security Update : dovecot23 (openSUSE-SU-2021:2892-1)	Nessus	SuSE Local Security Checks	medium
151697	openSUSE 15 Security Update : dovecot23 (openSUSE-SU-2021:2123-1)	Nessus	SuSE Local Security Checks	medium
151106	SUSE SLES15: dovecot23 / dovecot23-backend-mysql / dovecot23-backend-pgsql / etc (SUSE-SU-2021:2124-1)	Nessus	SuSE Local Security Checks	medium
151094	SUSE SLES15: dovecot23 / dovecot23-backend-mysql / dovecot23-backend-pgsql / etc (SUSE-SU-2021:2123-1)	Nessus	SuSE Local Security Checks	medium
151090	SUSE SLES15: dovecot23 / dovecot23-backend-mysql / dovecot23-backend-pgsql / etc (SUSE-SU-2021:2122-1)	Nessus	SuSE Local Security Checks	medium
151056	openSUSE 15 Security Update : dovecot23 (openSUSE-SU-2021:0920-1)	Nessus	SuSE Local Security Checks	medium
151003	FreeBSD : dovecot -- multiple vulnerabilities (d18f431d-d360-11eb-a32c-00a0989e4ec1)	Nessus	FreeBSD Local Security Checks	medium
150939	Ubuntu 20.04 LTS : Dovecot vulnerabilities (USN-4993-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2021-29157

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium