The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
CVSS Details
- CVSS 3.1 Base Score: 4.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade dovecot-pgsqlUpgrade dovecot-develUpgrade dovecot-mysqlUpgrade dovecot-pigeonholeUpgrade dovecot | May 13, 2022 | Jun 28, 2021 |
| Alpine Linux | — | Upgrade dovecot | Mar 26, 2024 | Jun 28, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 28, 2021 |
| Centos_linux | — | Upgrade dovecot-pigeonhole-debuginfoUpgrade dovecotUpgrade dovecot-debuginfoUpgrade dovecot-debugsourceUpgrade dovecot-mysql-debuginfoUpgrade dovecot-mysqlUpgrade dovecot-pgsqlUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-pigeonhole | May 13, 2022 | Jun 28, 2021 |
| Debian | — | Upgrade dovecot | Sep 28, 2022 | Jun 28, 2021 |
| Freebsd | — | Upgrade dovecot | Nov 4, 2022 | Jun 22, 2021 |
| Gentoo Linux | — | Upgrade net-mail/dovecot. | Jul 19, 2021 | Jun 28, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade dovecot-pigeonholeUpgrade dovecotUpgrade dovecot-mysql | Sep 24, 2021 | Jun 28, 2021 |
| Oracle_linux | — | Upgrade dovecotUpgrade dovecot-mysqlUpgrade dovecot-pigeonholeUpgrade dovecot-develUpgrade dovecot-pgsql | May 18, 2022 | Jun 21, 2021 |
| Redhat_linux | — | Upgrade dovecot-mysqlUpgrade dovecot-develUpgrade dovecotUpgrade dovecot-mysql-debuginfoUpgrade dovecot-debugsourceUpgrade dovecot-pgsqlUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-pigeonholeNo solution existsUpgrade dovecot-debuginfo | May 13, 2022 | Jun 28, 2021 |
| Rocky_linux | — | Upgrade dovecotUpgrade dovecot-debuginfoUpgrade dovecot-mysql-debuginfoUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-mysqlUpgrade dovecot-debugsourceUpgrade dovecot-pgsqlUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-develUpgrade dovecot-pigeonhole | May 20, 2022 | Jun 28, 2021 |
| Suse | — | Upgrade dovecot23-backend-sqliteUpgrade dovecot23-backend-pgsqlUpgrade dovecot23-backend-mysqlUpgrade dovecot23-fts-luceneUpgrade dovecot23-fts-solrUpgrade dovecot23Upgrade dovecot23-fts-squatUpgrade dovecot23-develUpgrade dovecot23-fts | Jun 23, 2021 | Jun 21, 2021 |
| Ubuntu | — | Upgrade dovecot-core | Jun 21, 2021 | Jun 21, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub