The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
CVSS Details
- CVSS 3.1 Base Score: 4.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade dovecot-mysqlUpgrade dovecotUpgrade dovecot-pigeonholeUpgrade dovecot-pgsqlUpgrade dovecot-devel | May 13, 2022 | Jun 28, 2021 |
| Alpine Linux | — | Upgrade dovecot | Mar 26, 2024 | Jun 28, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 28, 2021 |
| Centos_linux | — | Upgrade dovecot-pgsql-debuginfoUpgrade dovecot-pigeonholeUpgrade dovecot-pgsqlUpgrade dovecotUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-mysql-debuginfoUpgrade dovecot-debuginfoUpgrade dovecot-mysqlUpgrade dovecot-debugsource | May 13, 2022 | Jun 28, 2021 |
| Debian | — | Upgrade dovecot | Sep 28, 2022 | Jun 28, 2021 |
| Freebsd | — | Upgrade dovecot | Nov 4, 2022 | Jun 22, 2021 |
| Gentoo Linux | — | Upgrade net-mail/dovecot. | Jul 19, 2021 | Jun 28, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade dovecot-mysqlUpgrade dovecot-pigeonholeUpgrade dovecot | Sep 24, 2021 | Jun 28, 2021 |
| Oracle_linux | — | Upgrade dovecot-mysqlUpgrade dovecotUpgrade dovecot-pigeonholeUpgrade dovecot-pgsqlUpgrade dovecot-devel | May 18, 2022 | Jun 21, 2021 |
| Redhat_linux | — | Upgrade dovecot-pgsqlUpgrade dovecot-mysql-debuginfoUpgrade dovecot-debugsourceUpgrade dovecotUpgrade dovecot-mysqlUpgrade dovecot-develUpgrade dovecot-debuginfoNo solution existsUpgrade dovecot-pigeonholeUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-pigeonhole-debuginfo | May 13, 2022 | Jun 28, 2021 |
| Rocky_linux | — | Upgrade dovecot-pgsql-debuginfoUpgrade dovecot-develUpgrade dovecot-debugsourceUpgrade dovecot-pgsqlUpgrade dovecot-pigeonholeUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-mysql-debuginfoUpgrade dovecot-debuginfoUpgrade dovecotUpgrade dovecot-mysql | May 20, 2022 | Jun 28, 2021 |
| Suse | — | Upgrade dovecot23-fts-solrUpgrade dovecot23Upgrade dovecot23-backend-pgsqlUpgrade dovecot23-backend-sqliteUpgrade dovecot23-fts-squatUpgrade dovecot23-backend-mysqlUpgrade dovecot23-fts-luceneUpgrade dovecot23-ftsUpgrade dovecot23-devel | Jun 23, 2021 | Jun 21, 2021 |
| Ubuntu | — | Upgrade dovecot-core | Jun 21, 2021 | Jun 21, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub