An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade dovecot-develUpgrade dovecot-pigeonholeUpgrade dovecot-pgsqlUpgrade dovecotUpgrade dovecot-mysql | Nov 14, 2022 | Jul 17, 2022 |
| Alpine Linux | — | Upgrade dovecot | Mar 26, 2024 | Jul 17, 2022 |
| Amazon Linux Ami 2 | — | Upgrade dovecot-pgsqlUpgrade dovecot-develUpgrade dovecot-debuginfoUpgrade dovecot-mysqlUpgrade dovecot-pigeonholeUpgrade dovecot | Dec 5, 2023 | Jul 17, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 17, 2022 |
| Centos_linux | — | Upgrade dovecot-debuginfoUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-pgsqlUpgrade dovecot-mysql-debuginfoUpgrade dovecot-mysqlUpgrade dovecot-pigeonholeUpgrade dovecotUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-debugsource | Nov 9, 2022 | Jul 17, 2022 |
| Debian | — | Upgrade dovecot | Sep 28, 2022 | Jul 17, 2022 |
| Gentoo Linux | — | Upgrade net-mail/dovecot. | Oct 31, 2023 | Jul 17, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade dovecotUpgrade dovecot-pigeonholeUpgrade dovecot-mysql | Oct 11, 2022 | Jul 17, 2022 |
| Oracle_linux | — | Upgrade dovecot-develUpgrade dovecot-mysqlUpgrade dovecot-pgsqlUpgrade dovecot-pigeonholeUpgrade dovecot | Nov 16, 2022 | Jul 6, 2022 |
| Redhat_linux | — | Upgrade dovecot-pgsqlUpgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-develUpgrade dovecot-pigeonholeUpgrade dovecot-debuginfoUpgrade dovecotUpgrade dovecot-debugsourceUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-mysql-debuginfoUpgrade dovecot-mysql | Nov 9, 2022 | Jul 17, 2022 |
| Rocky_linux | — | Upgrade dovecot-pigeonhole-debuginfoUpgrade dovecot-pigeonholeUpgrade dovecot-pgsqlUpgrade dovecot-develUpgrade dovecot-pgsql-debuginfoUpgrade dovecot-debugsourceUpgrade dovecot-mysql-debuginfoUpgrade dovecot-mysqlUpgrade dovecot-debuginfoUpgrade dovecot | Mar 12, 2024 | Jul 17, 2022 |
| Suse | — | Upgrade dovecot23-backend-mysqlUpgrade dovecot23-ftsUpgrade dovecot22Upgrade dovecot22-backend-pgsqlUpgrade dovecot23-develUpgrade dovecot23-fts-solrUpgrade dovecot23-backend-pgsqlUpgrade dovecot22-backend-mysqlUpgrade dovecot22-backend-sqliteUpgrade dovecot23Upgrade dovecot22-develUpgrade dovecot23-backend-sqliteUpgrade dovecot23-fts-squatUpgrade dovecot23-fts-lucene | Oct 26, 2022 | Jul 17, 2022 |
| Ubuntu | — | Upgrade dovecot-core | Mar 22, 2023 | Jul 17, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub