The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
CVSS Details
- CVSS 3.1 Base Score: 4.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade dovecot-develUpgrade dovecot-pgsqlUpgrade dovecot-pigeonholeUpgrade dovecotUpgrade dovecot-mysql | May 13, 2022 | Jun 28, 2021 |
| Alpine Linux | — | Upgrade dovecot | Mar 26, 2024 | Jun 28, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 28, 2021 |
| Centos_linux | — | Upgrade dovecot-pigeonholeUpgrade dovecot-pgsqlUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-mysqlUpgrade dovecot-mysql-debuginfoUpgrade dovecot-debugsourceUpgrade dovecotUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-debuginfo | May 13, 2022 | Jun 28, 2021 |
| Debian | — | Upgrade dovecot | Sep 28, 2022 | Jun 28, 2021 |
| Freebsd | — | Upgrade dovecot | Nov 4, 2022 | Jun 22, 2021 |
| Gentoo Linux | — | Upgrade net-mail/dovecot. | Jul 19, 2021 | Jun 28, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade dovecot-pigeonholeUpgrade dovecotUpgrade dovecot-mysql | Sep 24, 2021 | Jun 28, 2021 |
| Oracle_linux | — | Upgrade dovecot-pgsqlUpgrade dovecot-develUpgrade dovecot-pigeonholeUpgrade dovecot-mysqlUpgrade dovecot | May 18, 2022 | Jun 21, 2021 |
| Redhat_linux | — | Upgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-debuginfoUpgrade dovecot-pgsql-debuginfoNo solution existsUpgrade dovecot-pigeonholeUpgrade dovecot-mysqlUpgrade dovecot-develUpgrade dovecot-mysql-debuginfoUpgrade dovecot-pgsqlUpgrade dovecot-debugsourceUpgrade dovecot | May 13, 2022 | Jun 28, 2021 |
| Rocky_linux | — | Upgrade dovecot-pigeonholeUpgrade dovecot-debugsourceUpgrade dovecot-develUpgrade dovecot-pgsqlUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-mysqlUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-mysql-debuginfoUpgrade dovecotUpgrade dovecot-debuginfo | May 20, 2022 | Jun 28, 2021 |
| Suse | — | Upgrade dovecot23-backend-sqliteUpgrade dovecot23-fts-luceneUpgrade dovecot23-backend-mysqlUpgrade dovecot23-fts-squatUpgrade dovecot23-backend-pgsqlUpgrade dovecot23-fts-solrUpgrade dovecot23Upgrade dovecot23-develUpgrade dovecot23-fts | Jun 23, 2021 | Jun 21, 2021 |
| Ubuntu | — | Upgrade dovecot-core | Jun 21, 2021 | Jun 21, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub