An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade dovecot-develUpgrade dovecot-pigeonholeUpgrade dovecot-pgsqlUpgrade dovecot-mysqlUpgrade dovecot | Nov 14, 2022 | Jul 17, 2022 |
| Alpine Linux | — | Upgrade dovecot | Mar 26, 2024 | Jul 17, 2022 |
| Amazon Linux Ami 2 | — | Upgrade dovecot-mysqlUpgrade dovecot-pigeonholeUpgrade dovecotUpgrade dovecot-debuginfoUpgrade dovecot-pgsqlUpgrade dovecot-devel | Dec 5, 2023 | Jul 17, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 17, 2022 |
| Centos_linux | — | Upgrade dovecot-mysql-debuginfoUpgrade dovecotUpgrade dovecot-debugsourceUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-pigeonholeUpgrade dovecot-mysqlUpgrade dovecot-pgsqlUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-debuginfo | Nov 9, 2022 | Jul 17, 2022 |
| Debian | — | Upgrade dovecot | Sep 28, 2022 | Jul 17, 2022 |
| Gentoo Linux | — | Upgrade net-mail/dovecot. | Oct 31, 2023 | Jul 17, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade dovecot-mysqlUpgrade dovecotUpgrade dovecot-pigeonhole | Oct 11, 2022 | Jul 17, 2022 |
| Oracle_linux | — | Upgrade dovecotUpgrade dovecot-mysqlUpgrade dovecot-pgsqlUpgrade dovecot-pigeonholeUpgrade dovecot-devel | Nov 16, 2022 | Jul 6, 2022 |
| Redhat_linux | — | Upgrade dovecot-develUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-pgsqlUpgrade dovecot-pigeonholeUpgrade dovecot-pgsql-debuginfoUpgrade dovecotUpgrade dovecot-mysql-debuginfoUpgrade dovecot-debugsourceUpgrade dovecot-debuginfoUpgrade dovecot-mysql | Nov 9, 2022 | Jul 17, 2022 |
| Rocky_linux | — | Upgrade dovecot-pigeonholeUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-develUpgrade dovecot-pgsqlUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-mysql-debuginfoUpgrade dovecotUpgrade dovecot-debuginfoUpgrade dovecot-mysqlUpgrade dovecot-debugsource | Mar 12, 2024 | Jul 17, 2022 |
| Suse | — | Upgrade dovecot23-fts-squatUpgrade dovecot23-fts-luceneUpgrade dovecot22-develUpgrade dovecot23-backend-sqliteUpgrade dovecot23Upgrade dovecot22-backend-sqliteUpgrade dovecot23-ftsUpgrade dovecot23-develUpgrade dovecot22Upgrade dovecot22-backend-mysqlUpgrade dovecot22-backend-pgsqlUpgrade dovecot23-backend-pgsqlUpgrade dovecot23-fts-solrUpgrade dovecot23-backend-mysql | Oct 26, 2022 | Jul 17, 2022 |
| Ubuntu | — | Upgrade dovecot-core | Mar 22, 2023 | Jul 17, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub