DeutschShown in its original language — a full translation is planned for a future version.
Dovecot: Mehrere Schwachstellen
view advisory published 2021-06-21
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Dovecot ausnutzen, um einen Denial of Service Angriff durchzuführen, Benutzerrechte erlangen oder Informationen offenzulegen.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-33515US | medium4.8 | — | ||
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address. | ||||
| CVE-2020-28200US | medium4.3 | — | ||
The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension. | ||||
| CVE-2021-29157US | medium5.5 | — | ||
Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2022:1950 vom 2022-05-10external
- Dovecot Security Advisory vom 2021-06-21external
- Dovecot Security Advisory vom 2021-06-21external
- Dovecot Security Advisory vom 2021-06-21external
- Dovecot Security Advisory vom 2021-06-21external
- Dovecot Security Advisory vom 2021-06-21external
- Debian Security Advisory DLA-3122 vom 2022-09-27external
- openSUSE Security Update OPENSUSE-SU-2025:14715-1 vom 2025-01-31external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan