An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade dovecotUpgrade dovecot-mysqlUpgrade dovecot-develUpgrade dovecot-pgsqlUpgrade dovecot-pigeonhole | Nov 14, 2022 | Jul 17, 2022 |
| Alpine Linux | — | Upgrade dovecot | Mar 26, 2024 | Jul 17, 2022 |
| Amazon Linux Ami 2 | — | Upgrade dovecot-develUpgrade dovecot-debuginfoUpgrade dovecot-pgsqlUpgrade dovecot-mysqlUpgrade dovecotUpgrade dovecot-pigeonhole | Dec 5, 2023 | Jul 17, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 17, 2022 |
| Centos_linux | — | Upgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-debuginfoUpgrade dovecot-pgsqlUpgrade dovecot-debugsourceUpgrade dovecotUpgrade dovecot-mysql-debuginfoUpgrade dovecot-pigeonholeUpgrade dovecot-mysqlUpgrade dovecot-pgsql-debuginfo | Nov 9, 2022 | Jul 17, 2022 |
| Debian | — | Upgrade dovecot | Sep 28, 2022 | Jul 17, 2022 |
| Gentoo Linux | — | Upgrade net-mail/dovecot. | Oct 31, 2023 | Jul 17, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade dovecot-mysqlUpgrade dovecot-pigeonholeUpgrade dovecot | Oct 11, 2022 | Jul 17, 2022 |
| Oracle_linux | — | Upgrade dovecotUpgrade dovecot-develUpgrade dovecot-mysqlUpgrade dovecot-pigeonholeUpgrade dovecot-pgsql | Nov 16, 2022 | Jul 6, 2022 |
| Redhat_linux | — | Upgrade dovecot-debugsourceUpgrade dovecot-mysql-debuginfoUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-debuginfoUpgrade dovecotUpgrade dovecot-mysqlUpgrade dovecot-develUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-pgsqlUpgrade dovecot-pigeonhole | Nov 9, 2022 | Jul 17, 2022 |
| Rocky_linux | — | Upgrade dovecot-pgsql-debuginfoUpgrade dovecot-pgsqlUpgrade dovecot-develUpgrade dovecot-pigeonholeUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecotUpgrade dovecot-mysqlUpgrade dovecot-mysql-debuginfoUpgrade dovecot-debuginfoUpgrade dovecot-debugsource | Mar 12, 2024 | Jul 17, 2022 |
| Suse | — | Upgrade dovecot23-fts-luceneUpgrade dovecot23Upgrade dovecot23-backend-sqliteUpgrade dovecot23-fts-squatUpgrade dovecot22-develUpgrade dovecot23-backend-pgsqlUpgrade dovecot22Upgrade dovecot22-backend-sqliteUpgrade dovecot23-ftsUpgrade dovecot22-backend-mysqlUpgrade dovecot23-backend-mysqlUpgrade dovecot22-backend-pgsqlUpgrade dovecot23-fts-solrUpgrade dovecot23-devel | Oct 26, 2022 | Jul 17, 2022 |
| Ubuntu | — | Upgrade dovecot-core | Mar 22, 2023 | Jul 17, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub