Path traversal in Dovecot - CVE-2021-29157

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU54285

Path traversal in Dovecot - CVE-2021-29157

Published: June 21, 2021


Vulnerability identifier: #VU54285
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-29157
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to perform directory traversal attacks.

The vulnerability exists due to validation of kid and azp fields in JWT tokens. A local user to ability to control a JWT token location can login as any MTA user and access their emails.


Affected software

Dovecot
Gentoo Linux
Arch Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Server Applications
Ubuntu
Fedora
dovecot-core (Ubuntu package)
dovecot23-backend-mysql
dovecot23
dovecot23-fts-squat-debuginfo
dovecot23-fts-squat
dovecot23-fts-solr-debuginfo
dovecot23-fts-solr
dovecot23-fts-lucene-debuginfo
dovecot23-fts-lucene
dovecot23-fts-debuginfo
dovecot23-devel
dovecot23-fts
dovecot23-backend-mysql-debuginfo
dovecot23-backend-pgsql
dovecot23-backend-pgsql-debuginfo
dovecot23-backend-sqlite
dovecot23-backend-sqlite-debuginfo
dovecot23-debuginfo
dovecot23-debugsource
dovecot

How to mitigate CVE-2021-29157

Install update from vendor's website.

Dovecot - update to 2.3.15
dovecot-core (Ubuntu package) - addressed in versions 1:2.3.7.2-1ubuntu3.4, 1:2.3.11.3+dfsg1-2ubuntu0.2, 1:2.3.13+dfsg1-1ubuntu1.1
dovecot23-backend-mysql - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23 - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-fts-squat-debuginfo - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-fts-squat - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-fts-solr-debuginfo - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-fts-solr - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-fts-lucene-debuginfo - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-fts-lucene - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-fts-debuginfo - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-devel - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-fts - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-backend-mysql-debuginfo - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-backend-pgsql - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-backend-pgsql-debuginfo - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-backend-sqlite - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-backend-sqlite-debuginfo - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-debuginfo - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot23-debugsource - addressed in versions 2.3.11.3-4.35.1, 2.3.11.3-24.1, 2.3.11.3-55.1, 2.3.15-4.38.3, 2.3.15-27.3, 2.3.15-58.3
dovecot - addressed in versions 2.3.15-1.fc33, 2.3.15-1.fc34

External References

Related Security Bulletins