Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.
{"prion": [{"lastseen": "2023-08-16T02:58:56", "description": "Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-06-28T12:15:00", "type": "prion", "title": "CVE-2021-29157", "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-29157"], "modified": "2021-09-20T18:52:00", "id": "PRION:CVE-2021-29157", "href": "https://kb.prio-n.com/vulnerability/CVE-2021-29157", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}}], "ubuntucve": [{"lastseen": "2023-05-28T13:28:59", "description": "Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to\nthe local filesystem can trick OAuth2 authentication into using an HS256\nvalidation key from an attacker-controlled location. This occurs during use\nof local JWT validation with the posix fs driver.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[mdeslaur](<https://launchpad.net/~mdeslaur>) | per upstream, this affects 2.3.11-2.3.14\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-06-21T00:00:00", "type": "ubuntucve", "title": "CVE-2021-29157", "bulletinFamily": "info", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-29157"], "modified": "2021-06-21T00:00:00", "id": "UB:CVE-2021-29157", "href": "https://ubuntu.com/security/CVE-2021-29157", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}}], "hackerone": [{"lastseen": "2022-10-09T13:24:51", "bounty": 982.0, "description": "# 0x01 Path Traversal in dict-fs module\nIf we use fs to store dictionaries, when program get the value of key:\n```\nstatic int fs_dict_lookup(struct dict *_dict, pool_t pool, const char *key,\n\t\t\t const char **value_r, const char **error_r)\n{\n\tstruct fs_dict *dict = (struct fs_dict *)_dict;\n\tstruct fs_file *file;\n\tstruct istream *input;\n\tconst unsigned char *data;\n\tsize_t size;\n\tconst char *path;\n\tstring_t *str;\n\tint ret;\n\n\tpath = fs_dict_get_full_key(dict, key);\n\tfile = fs_file_init(dict->fs, path, FS_OPEN_MODE_READONLY);\n\tinput = fs_read_stream(file, IO_BLOCK_SIZE);\n\t......\n}\n```\nThe function fs_dict_lookup will directly use the string of the key as a file_path to read key file, which will lead to a Path Traversal. In some cases, it will leak some important files in the system.\n\n# 0x02 Using \"azp\" field without checking Escape Character in oauth2-jwt\n\nWhen the program parses the jwt request and checks the signature:\n```\nint oauth2_try_parse_jwt(const struct oauth2_settings *set,\n\t\t\t const char *token, ARRAY_TYPE(oauth2_field) *fields,\n\t\t\t bool *is_jwt_r, const char **error_r)\n{\n......\n......\n\tsize_t pos = strcspn(kid, \"./%\");\n\tif (pos < strlen(kid)) {\n\t\t/* sanitize kid, cannot allow dots or / in it, so we encode them\n\t\t */\n\t\tstring_t *new_kid = t_str_new(strlen(kid));\n\t\t/* put initial data */\n\t\tstr_append_data(new_kid, kid, pos);\n\t\tfor (const char *c = kid+pos; *c != '\\0'; c++) {\n\t\t\tswitch (*c) {\n\t\t\tcase '.':\n\t\t\t\tstr_append(new_kid, \"%2e\");\n\t\t\t\tbreak;\n\t\t\tcase '/':\n\t\t\t\tstr_append(new_kid, \"%2f\");\n\t\t\t\tbreak;\n\t\t\tcase '%':\n\t\t\t\tstr_append(new_kid, \"%25\");\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\tstr_append_c(new_kid, *c);\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t\tkid = str_c(new_kid);\n\t}\n......\n......\n}\n\nstatic int\noauth2_jwt_body_process(const struct oauth2_settings *set, const char *alg,\n\t\t\tconst char *kid, ARRAY_TYPE(oauth2_field) *fields,\n\t\t\tstruct json_tree *tree, const char *const *blobs,\n\t\t\tconst char **error_r)\n{\n\t.......\n\t/* see if there is azp */\n\tconst char *azp = get_field(tree, \"azp\");\n\tif (azp == NULL)\n\t\tazp = \"default\";\n\n\tif (oauth2_validate_signature(set, azp, alg, kid, blobs, error_r) < 0)\n\t\treturn -1;\n\n\toauth2_jwt_copy_fields(fields, tree);\n\treturn 0;\n}\n```\nThe function oauth2_try_parse_jwt will encode the \"key\" field but directly use \"azp\" field, after that, it will call oauth2_lookup_pubkey/oauth2_lookup_hmac_key:\n```\n\tlookup_key = t_strconcat(DICT_PATH_SHARED, azp, \"/\", alg, \"/\", key_id,\n\t\t\t\t NULL);\n\tif ((ret = dict_lookup(set->key_dict, pool_datastack_create(),\n\t\t\t lookup_key, &base64_key, error_r)) < 0) {\n\t\treturn -1;\n\t} else if (ret == 0) {\n\t\t*error_r = t_strdup_printf(\"%s key '%s' not found\",\n\t\t\t\t\t alg, key_id);\n\t\treturn -1;\n\t}\n```\nThe fields will be spliced directly and used as key to call dict_lookup function.\nThis provides a way to construct arbitrary strings as a key to use dict module.\nFortunately, there is an escape character check / map check in dict-sql/redis/ladp....... , but we can exploit it with dict-fs module[0x03].\nI think using this field will become an easy way to be used in the future for attackers to break the dict module and complete the exploit.\n\n# 0x03 GET Authorized\n\nIf users enable the oauth2 module and use:\n```\nintrospection_mode = local\nlocal_validation_key_dict = fs:posix:prefix=/etc/dovecot/keys/\n```\nas an authentication way.\nAnd if attackers can write a fake dict-key file in filesystem, like:\n```\n/tmp/HS512/default:\nMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMQ==\n```\n Attackers can bypass the oauth2 with a specially crafted jwt message, like that:\n```\n{\n \"alg\": \"HS512\",\n \"typ\": \"JWT\"\n}\n{\n \"sub\": \"username\",\n \"iat\": 1616400286,\n \"exp\": 1616400886,\n \"azp\": \"../../../tmp\",\n \"email\": \"username\"\n}\n......(signature)\n```\nwith azp like \"../../../tmp\", it will cause the Path Traversal in dict-fs module, so that attackers can control the key which be used to verify the jwt request, then bypass the oauth2 and login in.\n\n## Impact\n\nThe Path Traversal will leak arbitrary files in the system when users use dict-fs module in some cases.\nAnd using \"azp\" field without checking Escape Character in oauth2-jwt will be more conducive for attackers to exploit the dict module. As the exploit in 0x03, attackers can bypass the oauth2 if they can write a key file to filesystem.\nThere is a successfully exploit in Screenshot (in the attachment).", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-03-22T09:56:04", "type": "hackerone", "title": "Open-Xchange: Path Traversal in dict-fs and no-check Escape Character in oauth2-jwt", "bulletinFamily": "bugbounty", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-29157"], "modified": "2021-09-07T10:10:57", "id": "H1:1132160", "href": "https://hackerone.com/reports/1132160", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}}], "redhatcve": [{"lastseen": "2023-05-27T17:16:56", "description": "A flaw was found in dovecot where it did not properly parse the `kid` and `azp` fields in JWT tokens. This flaw allows a local attacker to bypass dovecot's authentication, and access a user's emails. The highest threat from this vulnerability is to confidentiality and integrity.\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-06-21T15:05:59", "type": "redhatcve", "title": "CVE-2021-29157", "bulletinFamily": "info", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-29157"], "modified": "2023-04-06T07:55:33", "id": "RH:CVE-2021-29157", "href": "https://access.redhat.com/security/cve/cve-2021-29157", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}}], "debiancve": [{"lastseen": "2023-05-27T15:12:43", "description": "Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-06-28T12:15:00", "type": "debiancve", "title": "CVE-2021-29157", "bulletinFamily": "info", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-29157"], "modified": "2021-06-28T12:15:00", "id": "DEBIANCVE:CVE-2021-29157", "href": "https://security-tracker.debian.org/tracker/CVE-2021-29157", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}}], "veracode": [{"lastseen": "2022-07-26T16:32:55", "description": "Dovecot is vulnerable to arbitrary file write. It does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens in some configurations. This requires attacker to be able to write files to local disk.\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-06-23T19:01:08", "type": "veracode", "title": "Arbitrary File Write", "bulletinFamily": "software", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-29157"], "modified": "2021-06-24T02:14:27", "id": "VERACODE:31040", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-31040/summary", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}}], "cve": [{"lastseen": "2023-05-27T14:36:47", "description": "Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-06-28T12:15:00", "type": "cve", "title": "CVE-2021-29157", "cwe": ["CWE-22"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-29157"], "modified": "2021-09-20T18:52:00", "cpe": ["cpe:/o:fedoraproject:fedora:33", "cpe:/o:fedoraproject:fedora:34"], "id": "CVE-2021-29157", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-29157", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*"]}], "suse": [{"lastseen": "2022-11-10T08:10:18", "description": "An update that fixes two vulnerabilities is now available.\n\nDescription:\n\n This update for dovecot23 fixes the following issues:\n\n - CVE-2021-29157: Local attacker can login as any user and access their\n emails (bsc#1187418)\n - CVE-2021-33515: Attacker can potentially steal user credentials and\n mails (bsc#1187419)\n\n\nPatch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended installation methods\n like YaST online_update or \"zypper patch\".\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.3:\n\n zypper in -t patch openSUSE-SLE-15.3-2021-2123=1", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-07-11T00:00:00", "type": "suse", "title": "Security update for dovecot23 (important)", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-29157", "CVE-2021-33515"], "modified": "2021-07-11T00:00:00", "id": "OPENSUSE-SU-2021:2123-1", "href": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G567PZ5Z5XTMWM5HHQHCWSMCWQSOWCGA/", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2022-04-18T12:40:22", "description": "An update that fixes two vulnerabilities is now available.\n\nDescription:\n\n This update for dovecot23 fixes the following issues:\n\n - CVE-2021-29157: Local attacker can login as any user and access their\n emails (bsc#1187418)\n - CVE-2021-33515: Attacker can potentially steal user credentials and\n mails (bsc#1187419)\n\n\nPatch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended installation methods\n like YaST online_update or \"zypper patch\".\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.2:\n\n zypper in -t patch openSUSE-2021-920=1", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-06-25T00:00:00", "type": "suse", "title": "Security update for dovecot23 (important)", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-29157", "CVE-2021-33515"], "modified": "2021-06-25T00:00:00", "id": "OPENSUSE-SU-2021:0920-1", "href": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VRGETVIUWL6C53ONKOWQB6XMHGC4U2YM/", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2022-11-10T02:11:47", "description": "An update that solves two vulnerabilities, contains one\n feature and has one errata is now available.\n\nDescription:\n\n This update for dovecot23 fixes the following issues:\n\n Update dovecot to version 2.3.15 (jsc#SLE-19970):\n\n Security issues fixed:\n\n - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in\n JWT tokens. This may be used to supply attacker controlled keys to\n validate tokens, if attacker has local access. (bsc#1187418) Local\n attacker can login as any user and access their emails\n - CVE-2021-33515: On-path attacker could have injected plaintext commands\n before STARTTLS negotiation that would be executed after STARTTLS\n finished with the client. (bsc#1187419) Attacker can potentially steal\n user credentials and mails\n\n * Disconnection log messages are now more standardized across services.\n They also always now start with \"Disconnected\" prefix.\n * Dovecot now depends on libsystemd for systemd integration.\n * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.\n * config: Some settings are now marked as \"hidden\". It's discouraged to\n change these settings. They will no longer be visible in doveconf\n output, except if they have been changed or if doveconf -s parameter is\n used. See https://doc.dovecot.org/settings/advanced/ for details.\n * imap-compress: Compression level is now algorithm specific. See\n https://doc.dovecot.org/settings/plugin/compress-plugin/\n * indexer-worker: Convert \"Indexed\" info logs to an event named\n \"indexer_worker_indexing_finished\". See\n https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexin\n g-finished\n + Add TSLv1.3 support to min_protocols.\n + Allow configuring ssl_cipher_suites. (for TLSv1.3+)\n + acl: Add acl_ignore_namespace setting which allows to entirely ignore\n ACLs for the listed namespaces.\n + imap: Support official RFC8970 preview/snippet syntax. Old methods of\n retrieving preview information via IMAP commands (\"SNIPPET and PREVIEW\n with explicit algorithm selection\") have been deprecated.\n + imapc: Support INDEXPVT for imapc storage to enable private message\n flags for cluster wide shared mailboxes.\n + lib-storage: Add new events: mail_opened, mail_expunge_requested,\n mail_expunged, mail_cache_lookup_finished. See\n https://doc.dovecot.org/admin_manual/list_of_events/#mail\n + zlib, imap-compression, fs-compress: Support compression levels that the\n algorithm supports. Before, we would allow hardcoded value between 1 to\n 9 and would default to 6. Now we allow using per-algorithm value range\n and default to whatever default the algorithm specifies.\n - *-login: Commands pipelined together with and just after the\n authenticate command cause these commands to be executed twice. This\n applies to all protocols that involve user login, which currently\n comprises of imap, pop3, submisision and managesieve.\n - *-login: Processes are supposed to disconnect the oldest non-logged in\n connection when process_limit was reached. This didn't actually happen\n with the default \"high-security mode\" (with service_count=1) where each\n connection is handled by a separate process.\n - *-login: When login process reaches client/process limits, oldest client\n connections are disconnected. If one of these was still doing anvil\n lookup, this caused a crash. This could happen only if the login process\n limits were very low or if the server was overloaded.\n - Fixed building with link time optimizations (-flto).\n - auth: Userdb iteration with passwd driver does not always return all\n users with some nss drivers.\n - dsync: Shared INBOX not synced when \"mail_shared_explicit_inbox\" was\n disabled. If a user has a shared mailbox which is another user's INBOX,\n dsync didn't include the mailbox in syncing unless explicit naming is\n enabled with \"mail_shared_explicit_inbox\" set to \"yes\".\n - dsync: Shared namespaces were not synced with \"-n\" flag.\n - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.\n If a user has a shared mailbox that is another user's INBOX, dsync\n failed to export the mailbox if mail attributes are disabled.\n - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP\n requests to assert-crash: Panic: file http-client-request.c: line 1232\n (http_client_request_send_more): assertion failed: (req->payload_input\n != NULL)\n - fts-tika: 5xx errors returned by Tika server as indexing failures.\n However, Tika can return 5xx for some attachments every time. So the 5xx\n error should be retried once, but treated as success if it happens on\n the retry as well. v2.3 regression.\n - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have\n resulted in Panic: file message-parser.c: line 802\n (message_parser_deinit_from_parts): assertion failed:\n (ctx->nested_parts_count == 0 || i_stream_have_bytes_left(ctx->input))\n - imap: SETMETADATA could not be used to unset metadata values. Instead\n NIL was handled as a \"NIL\" string. v2.3.14 regression.\n - imap: IMAP BINARY FETCH crashes at least on empty base64 body: Panic:\n file index-mail-binary.c: line 358 (blocks_count_lines): assertion\n failed: (block_count == 0 || block_idx+1 == block_count)\n - imap: If IMAP client using the NOTIFY command was disconnected while\n sending FETCH notifications to the client, imap could crash with Panic:\n Trying to close mailbox INBOX with open transactions.\n - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang\n when IMAP commands are >8 kB long.\n - imapc: If remote server sent BYE but didn't immediately disconnect, it\n could cause infinite busy-loop.\n - lib-index: Corrupted cache record size in dovecot.index.cache file could\n have caused a crash (segfault) when accessing it.\n - lib-oauth2: JWT token time validation now works correctly with 32-bit\n systems.\n - lib-ssl-iostream: Checking hostnames against an SSL certificate was\n case-sensitive.\n - lib-storage: Corrupted mime.parts in dovecot.index.cache may have\n resulted in Panic: file imap-bodystructure.c: line 206\n (part_write_body): assertion failed: (text == ((part->flags &\n MESSAGE_PART_FLAG_TEXT) != 0))\n - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't\n preserve the \"hdr-pop3-uidl\" header. Because of this, the next pop3\n session could have accessed all of the emails' metadata to read their\n POP3 UIDL (opening dbox files).\n - listescape: When using the listescape plugin and a shared namespace the\n plugin didn't work properly anymore resulting in errors like: \"Invalid\n mailbox name: Name must not have '/' character.\"\n - lmtp: Connection crashes if connection gets disconnected due to multiple\n bad commands and the last bad command is BDAT.\n - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly\n forwarded by LMTP proxy without checking that the backend has support.\n This caused a command parameter error from the backend if it was running\n an older Dovecot release. This could only occur in more complex setups\n where the message was proxied twice; when the proxy generated the\n XRCPTFORWARD parameter itself the problem did not occur, so this\n only happened when it was forwarded.\n - lmtp: The LMTP proxy crashes with a panic when the remote server replies\n with an error while the mail is still being forwarded through a\n DATA/BDAT command.\n - lmtp: Username may have been missing from lmtp log line prefixes when it\n was performing autoexpunging.\n - master: Dovecot would incorrectly fail with haproxy 2.0.14 service\n checks.\n - master: Systemd service: Dovecot announces readiness for accepting\n connections earlier than it should. The following environment variables\n are now imported automatically and can be omitted from\n import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.\n - master: service { process_min_avail } was launching processes too slowly\n when master was forking a lot of processes.\n - util: Make the health-check.sh example script POSIX shell compatible.\n * Added new aliases for some variables. Usage of the old ones is possible,\n but discouraged. (These were partially added already to v2.3.13.) See\n https://doc.dovecot.org/configuration_manual/config_file/config_variables/\n for more information.\n * Optimize imap/pop3/submission/managesieve proxies to use less CPU at the\n cost of extra memory usage.\n * Remove autocreate, expire, snarf and mail-filter plugins.\n * Remove cydir storage driver.\n * Remove XZ/LZMA write support. Read support will be removed in future\n release.\n * doveadm -D: Add timestamps to debug output even when\n LOG_STDERR_TIMESTAMP environment variable is not set. Timestamp format\n is taken from log_timestamp setting.\n * If BROKENCHAR or listescape plugin is used, the escaped folder names may\n be slightly different from before in some situations. This is unlikely\n to cause issues, although caching clients may redownload the folders.\n * imapc: It now enables BROKENCHAR=~ by default to escape remote folder\n names if necessary. This also means that if there are any '~' characters\n in the remote folder names, they will be visible as \"~7e\".\n * imapc: When using local index files folder names were escaped on\n filesystem a bit differently. This affects only if there are folder\n names that actually require escaping, which isn't so common. The old\n style folders will be automatically deleted from filesystem.\n * stats: Update exported metrics to be compliant with OpenMetrics standard.\n + doveadm: Add an optional '-p' parameter to metadata list command. If\n enabled, \"/private\", and \"/shared\" metadata prefixes will be prepended\n to the keys in the list output.\n + doveconf: Support environment variables in config files. See\n https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax\n /#environment-variables for more details.\n + indexer-worker: Change indexer to disconnect from indexer-worker after\n each request. This allows service indexer-worker's service_count &\n idle_kill settings to work. These can be used to restart indexer-worker\n processes once in a while to reduce their memory usage.\n - auth: \"nodelay\" with various authentication mechanisms such as apop and\n digest-md5 crashed AUTH process if authentication failed.\n - auth: Auth lua script generating an error triggered an assertion\n failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):\n assertion failed: (lua_gettop(script->L) == 0).\n - configure: Fix libunwind detection to work on other than x86_64 systems.\n - doveadm-server: Process could crash if logging was done outside command\n handling. For example http-client could have done debug logging\n afterwards, resulting in either segfault or Panic: file http-client.c:\n line 642 (http_client_context_close): assertion failed:\n (cctx->clients_list == NULL).\n - dsync: Folder name escaping with BROKENCHAR didn't work completely\n correctly. This especially caused problems with dsync-migrations using\n imapc where some of the remote folder names may not have been accessible.\n - dsync: doveadm sync + imapc doesn't always sync all mails when doing an\n incremental sync (-1), which could lead to mail loss when it's used for\n migration. This happens only when GUIDs aren't used (i.e. imapc without\n imapc_features=guid-forced).\n - fts-tika: When tika server returns error, some mails cause Panic: file\n message-parser.c: line 802 (message_parser_deinit_from_parts): assertion\n failed: (ctx->nested_parts_count == 0 ||\n i_stream_have_bytes_left(ctx->input))\n - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have\n resulted in crashes. This exposed that Dovecot was wrongly accepting\n atoms in \"nstring\" handling. Changed the IMAP parsing to be more strict\n about this now.\n - lib-index: If dovecot.index.cache has corrupted message size, fetching\n BODY/BODYSTRUCTURE may cause assert-crash: Panic: file index-mail.c:\n line 1140 (index_mail_parse_body_finish): assertion failed:\n (mail->data.parts != NULL).\n - lib-index: Minor error handling and race condition fixes related to\n rotating dovecot.index.log. These didn't usually cause problems, unless\n the log files were rotated rapidly.\n - lib-lua: Lua scripts using coroutines or lua libraries using coroutines\n (e.g., cqueues) panicked.\n - Message PREVIEW handled whitespace wrong so first space would get eaten\n from between words.\n - FTS and message PREVIEW (snippet) parsed HTML &entities case-sensitively.\n - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE\n was written in a way that may have caused confusion for IMAP clients and\n also Dovecot itself when parsing it. The truncated part is now written\n out using application/octet-stream MIME type.\n - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to\n use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:\n (meth->context_size <= MAC_MAX_CONTEXT_SIZE).\n - event filters: NOT keyword did not have the correct associativity.\n - Ignore ECONNRESET when closing socket. This avoids logging useless\n errors on systems like FreeBSD.\n - event filters: event filter syntax error may lead to Panic: file\n event-filter.c: line 137 (event_filter_parse): assertion failed:\n (state.output == NULL)\n - lib: timeval_cmp_margin() was broken on 32-bit systems. This could\n potentially have caused HTTP timeouts to be handled incorrectly.\n - log: instance_name wasn't used as syslog ident by the log process.\n - master: After a service reached process_limit and client_limit, it could\n have taken up to 1 second to realize that more client connections became\n available. During this time client connections could have been\n unnecessarily rejected and a warning logged: Warning: service(...):\n process_limit (...) reached, client connections are being dropped\n - stats: Crash would occur when generating openmetrics data for metrics\n using aggregating functions.\n - stats: Event filters comparing against empty strings crash the stats\n process.\n * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to\n allow logged in user to access other people's emails and filesystem\n information.\n * Metric filter and global event filter variable syntax changed to a\n SQL-like format. See\n https://doc.dovecot.org/configuration_manual/event_filter/\n * auth: Added new aliases for %{variables}. Usage of the old ones is\n possible, but discouraged.\n * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth\n mechanism and related password schemes.\n * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.\n * auth: Removed postfix postmap socket\n + auth: Added new fields for auth server events. These fields are now also\n available for all auth events. See\n https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server\n for details.\n + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated\n and imap_client_unhibernate_retried events. See\n https://doc.dovecot.org/admin_manual/list_of_events/ for details.\n + lib-index: Added new mail_index_recreated event. See\n https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated\n + lib-sql: Support TLS options for cassandra driver. This requires\n cpp-driver v2.15 (or later) to work reliably.\n + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now\n added to existing mails if mail_attachment_detection_option=add-flags\n and it can be done inexpensively.\n + login proxy: Added login_proxy_max_reconnects setting (default 3) to\n control how many reconnections are attempted.\n + login proxy: imap/pop3/submission/managesieve proxying now supports\n reconnection retrying on more than just connect() failure. Any error\n except a non-temporary authentication failure will result in reconnect\n attempts.\n - auth: Lua passdb/userdb leaks stack elements per call, eventually\n causing the stack to become too deep and crashing the auth or\n auth-worker process.\n - auth: SASL authentication PLAIN mechanism could be used to trigger read\n buffer overflow. However, this doesn't seem to be exploitable in any way.\n - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot\n disallows NUL bytes for it.\n - dict: Process used too much CPU when iterating keys, because each key\n used a separate write() syscall.\n - doveadm-server: Crash could occur if logging was done outside command\n handling. For example http-client could have done debug logging\n afterwards, resulting in either segfault or Panic: file http-client.c:\n line 642 (http_client_context_close): assertion failed:\n (cctx->clients_list == NULL).\n - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server\n process via starttls assert-crashed if there were no ssl=yes listeners:\n Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):\n assertion failed: (service->ssl_ctx_initialized).\n - fts-solr: HTTP requests may have assert-crashed: Panic: file\n http-client-request.c: line 1232 (http_client_request_send_more):\n assertion failed: (req->payload_input != NULL)\n - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad\n configuration that causes errors. Sending the error responses to the\n client can cause the segmentation fault. This can for example happen\n when several namespaces use the same mail storage location.\n - imap: IMAP NOTIFY used on a shared namespace that doesn't actually exist\n (e.g. public namespace for a nonexistent user) can crash with a panic:\n Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index:\n Opened in (null):0\n - imap: IMAP session can crash with QRESYNC extension if many changes are\n done before asking for expunged mails since last sync.\n - imap: Process might hang indefinitely if client disconnects after\n sending some long-running commands pipelined, for example FETCH+LOGOUT.\n - lib-compress: Mitigate crashes when configuring a not compiled in\n compression. Errors with compression configuration now distinguish\n between not supported and unknown.\n - lib-compression: Using xz/lzma compression in v2.3.11 could have written\n truncated output in some situations. This would result in \"Broken pipe\"\n read errors when trying to read it back.\n - lib-compression: zstd compression could have crashed in some situations:\n Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed:\n (!stream->blocking)\n - lib-dict: dict client could have crashed in some rare situations when\n iterating keys.\n - lib-http: Fix several assert-crashes in HTTP client.\n - lib-index: v2.3.11 regression: When mails were expunged at the same time\n as lots of new content was being saved to the cache (e.g. cache file was\n lost and is being re-filled) a deadlock could occur with\n dovecot.index.cache / dovecot.index.log.\n - lib-index: v2.3.11 regression: dovecot.index.cache file was being purged\n (rewritten) too often when it had a field that hadn't been accessed for\n over 1 month, but less than 2 months. Every cache file change caused a\n purging in this situation.\n - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.\n Regression caused by fixing CVE-2020-12100.\n - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE\n was written in a way that may have caused confusion for both IMAP\n clients and Dovecot itself when parsing it. The truncated part is now\n written out using application/octet-stream MIME type.\n - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the\n 10000th MIME part was message/rfc822 (or if parent was\n multipart/digest): Panic: file message-parser.c: line 167\n (message_part_append): assertion failed: (ctx->total_parts_count <=\n ctx->max_total_mime_parts).\n - lib-oauth2: Dovecot incorrectly required oauth2 server introspection\n reply to contain username with invalid token.\n - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has\n deprecated APIs disabled.\n - lib-storage: When mail's size is different from the cached one (in\n dovecot.index.cache or Maildir S=size in the filename), this is handled\n by logging \"Cached message size smaller/larger than expected\" error.\n However, in some situations this also ended up crashing with: Panic:\n file istream.c: line 315 (i_stream_read_memarea): assertion failed:\n (old_size <= _stream->pos - _stream->skip).\n - lib-storage: v2.3 regression: Copying/moving mails was taking much more\n memory than before. This was mainly visible when copying/moving\n thousands of mails in a single transaction.\n - lib-storage: v2.3.11 regression: Searching messages assert-crashed\n (without FTS): Panic: file message-parser.c: line 174\n (message_part_finish): assertion failed: (ctx->nested_parts_count > 0).\n - lib: Dovecot v2.3 moved signal handlers around in ioloops, causing more\n CPU usage than in v2.2.\n - lib: Fixed JSON parsing: '\\' escape sequence may have wrongly resulted\n in error if it happened to be at read boundary. Any NUL characters and\n '\\u0000' will now result in parsing error instead of silently truncating\n the data.\n - lmtp, submission: Server may hang if SSL client connection disconnects\n during the delivery. If this happened repeated, it could have ended up\n reaching process_limit and preventing any further lmtp/submission\n deliveries.\n - lmtp: Proxy does not always properly log TLS connection problems as\n errors; in some cases, only a debug message is logged if enabled.\n - lmtp: The LMTP service can hang when commands are pipelined. This can\n particularly occur when one command in the middle of the pipeline fails.\n One example of this occurs for proxied LMTP transactions in which the\n final DATA or BDAT command is pipelined after a failing RCPT command.\n - login-proxy: The login_source_ips setting has no effect, and therefore\n the proxy source IPs are not cycled through as they should be.\n - master: Process was using 100% CPU in some situations when a broken\n service was being throttled.\n - pop3-login: POP3 login would fail with \"Input buffer full\" if the\n initial response for SASL was too long.\n - stats: Crash would occur when generating openmetrics data for metrics\n using aggregating functions.\n\n Update pigeonhole to version 0.5.15\n\n * CVE-2020-28200: Sieve interpreter is not protected against abusive\n scripts that claim excessive resource usage. Fixed by limiting the user\n CPU time per single script execution and cumulatively over several\n script runs within a configurable timeout period. Sufficiently large CPU\n time usage is summed in the Sieve script binary and execution is blocked\n when the sum exceeds the limit within that time. The block is lifted\n when the script is updated after the resource usage times out.\n (bsc#1187420) Attacker can DoS the mail delivery system (jsc#PM-2746)\n ECO: Dovecot 2.3.15 version upgrade\n * Disconnection log messages are now more standardized across services.\n They also always now start with \"Disconnected\" prefix.\n * managesieve: Commands pipelined together with and just after the\n authenticate command cause these commands to be executed twice.\n * duplicate: The test was handled badly in a multiscript (sieve_before,\n sieve_after) scenario in which an earlier script in the sequence with a\n duplicate test succeeded, while a later script caused a runtime failure.\n In that case, the message is recorded for duplicate tracking, while the\n message may not actually have been delivered in the end.\n * editheader: Sieve interpreter entered infinite loop at startup when the\n \"editheader\" configuration listed an invalid header name. This problem\n can only be triggered by the administrator.\n * relational: The Sieve relational extension can cause a segfault at\n compile time. This is triggered by invalid script syntax. The segfault\n happens when this match type is the last argument of the test command.\n This situation is not possible in a valid script; positional arguments\n are normally present after that, which would prevent the segfault.\n * sieve: For some Sieve commands the provided mailbox name is not properly\n checked for UTF-8 validity, which can cause assert crashes at runtime\n when an invalid mailbox name is encountered. This can be caused by the\n user by writing a bad Sieve script involving the affected commands\n (\"mailboxexists\", \"specialuse_exists\"). This can be triggered by the\n remote sender only when the user has written a Sieve script that passes\n message content to one of the affected commands.\n * sieve: Large sequences of 8-bit octets passed to certain Sieve commands\n that create or modify message headers that allow UTF-8 text (vacation,\n notify and addheader) can cause the delivery or IMAP process (when\n IMAPSieve is used) to enter a memory-consuming semi-infinite loop that\n ends when the process exceeds its memory limits. Logged in users can\n cause these hangs only for their own processes.\n\n\n This update was imported from the SUSE:SLE-15-SP2:Update update project.\n\n\nPatch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended installation methods\n like YaST online_update or \"zypper patch\".\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.2:\n\n zypper in -t patch openSUSE-2021-1225=1", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-09-04T00:00:00", "type": "suse", "title": "Security update for dovecot23 (moderate)", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-12100", "CVE-2020-24386", "CVE-2020-28200", "CVE-2021-29157", "CVE-2021-33515"], "modified": "2021-09-04T00:00:00", "id": "OPENSUSE-SU-2021:1225-1", "href": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IOZSH4SD3B27NBLCL3T2IO4EVB6AMFYQ/", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2022-11-10T08:10:10", "description": "An update that solves two vulnerabilities, contains one\n feature and has one errata is now available.\n\nDescription:\n\n This update for dovecot23 fixes the following issues:\n\n Update dovecot to version 2.3.15 (jsc#SLE-19970):\n\n Security issues fixed:\n\n - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in\n JWT tokens. This may be used to supply attacker controlled keys to\n validate tokens, if attacker has local access. (bsc#1187418) Local\n attacker can login as any user and access their emails\n - CVE-2021-33515: On-path attacker could have injected plaintext commands\n before STARTTLS negotiation that would be executed after STARTTLS\n finished with the client. (bsc#1187419) Attacker can potentially steal\n user credentials and mails\n\n * Disconnection log messages are now more standardized across services.\n They also always now start with \"Disconnected\" prefix.\n * Dovecot now depends on libsystemd for systemd integration.\n * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.\n * config: Some settings are now marked as \"hidden\". It's discouraged to\n change these settings. They will no longer be visible in doveconf\n output, except if they have been changed or if doveconf -s parameter is\n used. See https://doc.dovecot.org/settings/advanced/ for details.\n * imap-compress: Compression level is now algorithm specific. See\n https://doc.dovecot.org/settings/plugin/compress-plugin/\n * indexer-worker: Convert \"Indexed\" info logs to an event named\n \"indexer_worker_indexing_finished\". See\n https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexin\n g-finished\n + Add TSLv1.3 support to min_protocols.\n + Allow configuring ssl_cipher_suites. (for TLSv1.3+)\n + acl: Add acl_ignore_namespace setting which allows to entirely ignore\n ACLs for the listed namespaces.\n + imap: Support official RFC8970 preview/snippet syntax. Old methods of\n retrieving preview information via IMAP commands (\"SNIPPET and PREVIEW\n with explicit algorithm selection\") have been deprecated.\n + imapc: Support INDEXPVT for imapc storage to enable private message\n flags for cluster wide shared mailboxes.\n + lib-storage: Add new events: mail_opened, mail_expunge_requested,\n mail_expunged, mail_cache_lookup_finished. See\n https://doc.dovecot.org/admin_manual/list_of_events/#mail\n + zlib, imap-compression, fs-compress: Support compression levels that the\n algorithm supports. Before, we would allow hardcoded value between 1 to\n 9 and would default to 6. Now we allow using per-algorithm value range\n and default to whatever default the algorithm specifies.\n - *-login: Commands pipelined together with and just after the\n authenticate command cause these commands to be executed twice. This\n applies to all protocols that involve user login, which currently\n comprises of imap, pop3, submisision and managesieve.\n - *-login: Processes are supposed to disconnect the oldest non-logged in\n connection when process_limit was reached. This didn't actually happen\n with the default \"high-security mode\" (with service_count=1) where each\n connection is handled by a separate process.\n - *-login: When login process reaches client/process limits, oldest client\n connections are disconnected. If one of these was still doing anvil\n lookup, this caused a crash. This could happen only if the login process\n limits were very low or if the server was overloaded.\n - Fixed building with link time optimizations (-flto).\n - auth: Userdb iteration with passwd driver does not always return all\n users with some nss drivers.\n - dsync: Shared INBOX not synced when \"mail_shared_explicit_inbox\" was\n disabled. If a user has a shared mailbox which is another user's INBOX,\n dsync didn't include the mailbox in syncing unless explicit naming is\n enabled with \"mail_shared_explicit_inbox\" set to \"yes\".\n - dsync: Shared namespaces were not synced with \"-n\" flag.\n - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.\n If a user has a shared mailbox that is another user's INBOX, dsync\n failed to export the mailbox if mail attributes are disabled.\n - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP\n requests to assert-crash: Panic: file http-client-request.c: line 1232\n (http_client_request_send_more): assertion failed: (req->payload_input\n != NULL)\n - fts-tika: 5xx errors returned by Tika server as indexing failures.\n However, Tika can return 5xx for some attachments every time. So the 5xx\n error should be retried once, but treated as success if it happens on\n the retry as well. v2.3 regression.\n - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have\n resulted in Panic: file message-parser.c: line 802\n (message_parser_deinit_from_parts): assertion failed:\n (ctx->nested_parts_count == 0 || i_stream_have_bytes_left(ctx->input))\n - imap: SETMETADATA could not be used to unset metadata values. Instead\n NIL was handled as a \"NIL\" string. v2.3.14 regression.\n - imap: IMAP BINARY FETCH crashes at least on empty base64 body: Panic:\n file index-mail-binary.c: line 358 (blocks_count_lines): assertion\n failed: (block_count == 0 || block_idx+1 == block_count)\n - imap: If IMAP client using the NOTIFY command was disconnected while\n sending FETCH notifications to the client, imap could crash with Panic:\n Trying to close mailbox INBOX with open transactions.\n - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang\n when IMAP commands are >8 kB long.\n - imapc: If remote server sent BYE but didn't immediately disconnect, it\n could cause infinite busy-loop.\n - lib-index: Corrupted cache record size in dovecot.index.cache file could\n have caused a crash (segfault) when accessing it.\n - lib-oauth2: JWT token time validation now works correctly with 32-bit\n systems.\n - lib-ssl-iostream: Checking hostnames against an SSL certificate was\n case-sensitive.\n - lib-storage: Corrupted mime.parts in dovecot.index.cache may have\n resulted in Panic: file imap-bodystructure.c: line 206\n (part_write_body): assertion failed: (text == ((part->flags &\n MESSAGE_PART_FLAG_TEXT) != 0))\n - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't\n preserve the \"hdr-pop3-uidl\" header. Because of this, the next pop3\n session could have accessed all of the emails' metadata to read their\n POP3 UIDL (opening dbox files).\n - listescape: When using the listescape plugin and a shared namespace the\n plugin didn't work properly anymore resulting in errors like: \"Invalid\n mailbox name: Name must not have '/' character.\"\n - lmtp: Connection crashes if connection gets disconnected due to multiple\n bad commands and the last bad command is BDAT.\n - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly\n forwarded by LMTP proxy without checking that the backend has support.\n This caused a command parameter error from the backend if it was running\n an older Dovecot release. This could only occur in more complex setups\n where the message was proxied twice; when the proxy generated the\n XRCPTFORWARD parameter itself the problem did not occur, so this\n only happened when it was forwarded.\n - lmtp: The LMTP proxy crashes with a panic when the remote server replies\n with an error while the mail is still being forwarded through a\n DATA/BDAT command.\n - lmtp: Username may have been missing from lmtp log line prefixes when it\n was performing autoexpunging.\n - master: Dovecot would incorrectly fail with haproxy 2.0.14 service\n checks.\n - master: Systemd service: Dovecot announces readiness for accepting\n connections earlier than it should. The following environment variables\n are now imported automatically and can be omitted from\n import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.\n - master: service { process_min_avail } was launching processes too slowly\n when master was forking a lot of processes.\n - util: Make the health-check.sh example script POSIX shell compatible.\n * Added new aliases for some variables. Usage of the old ones is possible,\n but discouraged. (These were partially added already to v2.3.13.) See\n https://doc.dovecot.org/configuration_manual/config_file/config_variables/\n for more information.\n * Optimize imap/pop3/submission/managesieve proxies to use less CPU at the\n cost of extra memory usage.\n * Remove autocreate, expire, snarf and mail-filter plugins.\n * Remove cydir storage driver.\n * Remove XZ/LZMA write support. Read support will be removed in future\n release.\n * doveadm -D: Add timestamps to debug output even when\n LOG_STDERR_TIMESTAMP environment variable is not set. Timestamp format\n is taken from log_timestamp setting.\n * If BROKENCHAR or listescape plugin is used, the escaped folder names may\n be slightly different from before in some situations. This is unlikely\n to cause issues, although caching clients may redownload the folders.\n * imapc: It now enables BROKENCHAR=~ by default to escape remote folder\n names if necessary. This also means that if there are any '~' characters\n in the remote folder names, they will be visible as \"~7e\".\n * imapc: When using local index files folder names were escaped on\n filesystem a bit differently. This affects only if there are folder\n names that actually require escaping, which isn't so common. The old\n style folders will be automatically deleted from filesystem.\n * stats: Update exported metrics to be compliant with OpenMetrics standard.\n + doveadm: Add an optional '-p' parameter to metadata list command. If\n enabled, \"/private\", and \"/shared\" metadata prefixes will be prepended\n to the keys in the list output.\n + doveconf: Support environment variables in config files. See\n https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax\n /#environment-variables for more details.\n + indexer-worker: Change indexer to disconnect from indexer-worker after\n each request. This allows service indexer-worker's service_count &\n idle_kill settings to work. These can be used to restart indexer-worker\n processes once in a while to reduce their memory usage.\n - auth: \"nodelay\" with various authentication mechanisms such as apop and\n digest-md5 crashed AUTH process if authentication failed.\n - auth: Auth lua script generating an error triggered an assertion\n failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):\n assertion failed: (lua_gettop(script->L) == 0).\n - configure: Fix libunwind detection to work on other than x86_64 systems.\n - doveadm-server: Process could crash if logging was done outside command\n handling. For example http-client could have done debug logging\n afterwards, resulting in either segfault or Panic: file http-client.c:\n line 642 (http_client_context_close): assertion failed:\n (cctx->clients_list == NULL).\n - dsync: Folder name escaping with BROKENCHAR didn't work completely\n correctly. This especially caused problems with dsync-migrations using\n imapc where some of the remote folder names may not have been accessible.\n - dsync: doveadm sync + imapc doesn't always sync all mails when doing an\n incremental sync (-1), which could lead to mail loss when it's used for\n migration. This happens only when GUIDs aren't used (i.e. imapc without\n imapc_features=guid-forced).\n - fts-tika: When tika server returns error, some mails cause Panic: file\n message-parser.c: line 802 (message_parser_deinit_from_parts): assertion\n failed: (ctx->nested_parts_count == 0 ||\n i_stream_have_bytes_left(ctx->input))\n - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have\n resulted in crashes. This exposed that Dovecot was wrongly accepting\n atoms in \"nstring\" handling. Changed the IMAP parsing to be more strict\n about this now.\n - lib-index: If dovecot.index.cache has corrupted message size, fetching\n BODY/BODYSTRUCTURE may cause assert-crash: Panic: file index-mail.c:\n line 1140 (index_mail_parse_body_finish): assertion failed:\n (mail->data.parts != NULL).\n - lib-index: Minor error handling and race condition fixes related to\n rotating dovecot.index.log. These didn't usually cause problems, unless\n the log files were rotated rapidly.\n - lib-lua: Lua scripts using coroutines or lua libraries using coroutines\n (e.g., cqueues) panicked.\n - Message PREVIEW handled whitespace wrong so first space would get eaten\n from between words.\n - FTS and message PREVIEW (snippet) parsed HTML &entities case-sensitively.\n - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE\n was written in a way that may have caused confusion for IMAP clients and\n also Dovecot itself when parsing it. The truncated part is now written\n out using application/octet-stream MIME type.\n - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to\n use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:\n (meth->context_size <= MAC_MAX_CONTEXT_SIZE).\n - event filters: NOT keyword did not have the correct associativity.\n - Ignore ECONNRESET when closing socket. This avoids logging useless\n errors on systems like FreeBSD.\n - event filters: event filter syntax error may lead to Panic: file\n event-filter.c: line 137 (event_filter_parse): assertion failed:\n (state.output == NULL)\n - lib: timeval_cmp_margin() was broken on 32-bit systems. This could\n potentially have caused HTTP timeouts to be handled incorrectly.\n - log: instance_name wasn't used as syslog ident by the log process.\n - master: After a service reached process_limit and client_limit, it could\n have taken up to 1 second to realize that more client connections became\n available. During this time client connections could have been\n unnecessarily rejected and a warning logged: Warning: service(...):\n process_limit (...) reached, client connections are being dropped\n - stats: Crash would occur when generating openmetrics data for metrics\n using aggregating functions.\n - stats: Event filters comparing against empty strings crash the stats\n process.\n * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to\n allow logged in user to access other people's emails and filesystem\n information.\n * Metric filter and global event filter variable syntax changed to a\n SQL-like format. See\n https://doc.dovecot.org/configuration_manual/event_filter/\n * auth: Added new aliases for %{variables}. Usage of the old ones is\n possible, but discouraged.\n * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth\n mechanism and related password schemes.\n * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.\n * auth: Removed postfix postmap socket\n + auth: Added new fields for auth server events. These fields are now also\n available for all auth events. See\n https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server\n for details.\n + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated\n and imap_client_unhibernate_retried events. See\n https://doc.dovecot.org/admin_manual/list_of_events/ for details.\n + lib-index: Added new mail_index_recreated event. See\n https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated\n + lib-sql: Support TLS options for cassandra driver. This requires\n cpp-driver v2.15 (or later) to work reliably.\n + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now\n added to existing mails if mail_attachment_detection_option=add-flags\n and it can be done inexpensively.\n + login proxy: Added login_proxy_max_reconnects setting (default 3) to\n control how many reconnections are attempted.\n + login proxy: imap/pop3/submission/managesieve proxying now supports\n reconnection retrying on more than just connect() failure. Any error\n except a non-temporary authentication failure will result in reconnect\n attempts.\n - auth: Lua passdb/userdb leaks stack elements per call, eventually\n causing the stack to become too deep and crashing the auth or\n auth-worker process.\n - auth: SASL authentication PLAIN mechanism could be used to trigger read\n buffer overflow. However, this doesn't seem to be exploitable in any way.\n - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot\n disallows NUL bytes for it.\n - dict: Process used too much CPU when iterating keys, because each key\n used a separate write() syscall.\n - doveadm-server: Crash could occur if logging was done outside command\n handling. For example http-client could have done debug logging\n afterwards, resulting in either segfault or Panic: file http-client.c:\n line 642 (http_client_context_close): assertion failed:\n (cctx->clients_list == NULL).\n - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server\n process via starttls assert-crashed if there were no ssl=yes listeners:\n Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):\n assertion failed: (service->ssl_ctx_initialized).\n - fts-solr: HTTP requests may have assert-crashed: Panic: file\n http-client-request.c: line 1232 (http_client_request_send_more):\n assertion failed: (req->payload_input != NULL)\n - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad\n configuration that causes errors. Sending the error responses to the\n client can cause the segmentation fault. This can for example happen\n when several namespaces use the same mail storage location.\n - imap: IMAP NOTIFY used on a shared namespace that doesn't actually exist\n (e.g. public namespace for a nonexistent user) can crash with a panic:\n Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index:\n Opened in (null):0\n - imap: IMAP session can crash with QRESYNC extension if many changes are\n done before asking for expunged mails since last sync.\n - imap: Process might hang indefinitely if client disconnects after\n sending some long-running commands pipelined, for example FETCH+LOGOUT.\n - lib-compress: Mitigate crashes when configuring a not compiled in\n compression. Errors with compression configuration now distinguish\n between not supported and unknown.\n - lib-compression: Using xz/lzma compression in v2.3.11 could have written\n truncated output in some situations. This would result in \"Broken pipe\"\n read errors when trying to read it back.\n - lib-compression: zstd compression could have crashed in some situations:\n Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed:\n (!stream->blocking)\n - lib-dict: dict client could have crashed in some rare situations when\n iterating keys.\n - lib-http: Fix several assert-crashes in HTTP client.\n - lib-index: v2.3.11 regression: When mails were expunged at the same time\n as lots of new content was being saved to the cache (e.g. cache file was\n lost and is being re-filled) a deadlock could occur with\n dovecot.index.cache / dovecot.index.log.\n - lib-index: v2.3.11 regression: dovecot.index.cache file was being purged\n (rewritten) too often when it had a field that hadn't been accessed for\n over 1 month, but less than 2 months. Every cache file change caused a\n purging in this situation.\n - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.\n Regression caused by fixing CVE-2020-12100.\n - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE\n was written in a way that may have caused confusion for both IMAP\n clients and Dovecot itself when parsing it. The truncated part is now\n written out using application/octet-stream MIME type.\n - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the\n 10000th MIME part was message/rfc822 (or if parent was\n multipart/digest): Panic: file message-parser.c: line 167\n (message_part_append): assertion failed: (ctx->total_parts_count <=\n ctx->max_total_mime_parts).\n - lib-oauth2: Dovecot incorrectly required oauth2 server introspection\n reply to contain username with invalid token.\n - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has\n deprecated APIs disabled.\n - lib-storage: When mail's size is different from the cached one (in\n dovecot.index.cache or Maildir S=size in the filename), this is handled\n by logging \"Cached message size smaller/larger than expected\" error.\n However, in some situations this also ended up crashing with: Panic:\n file istream.c: line 315 (i_stream_read_memarea): assertion failed:\n (old_size <= _stream->pos - _stream->skip).\n - lib-storage: v2.3 regression: Copying/moving mails was taking much more\n memory than before. This was mainly visible when copying/moving\n thousands of mails in a single transaction.\n - lib-storage: v2.3.11 regression: Searching messages assert-crashed\n (without FTS): Panic: file message-parser.c: line 174\n (message_part_finish): assertion failed: (ctx->nested_parts_count > 0).\n - lib: Dovecot v2.3 moved signal handlers around in ioloops, causing more\n CPU usage than in v2.2.\n - lib: Fixed JSON parsing: '\\' escape sequence may have wrongly resulted\n in error if it happened to be at read boundary. Any NUL characters and\n '\\u0000' will now result in parsing error instead of silently truncating\n the data.\n - lmtp, submission: Server may hang if SSL client connection disconnects\n during the delivery. If this happened repeated, it could have ended up\n reaching process_limit and preventing any further lmtp/submission\n deliveries.\n - lmtp: Proxy does not always properly log TLS connection problems as\n errors; in some cases, only a debug message is logged if enabled.\n - lmtp: The LMTP service can hang when commands are pipelined. This can\n particularly occur when one command in the middle of the pipeline fails.\n One example of this occurs for proxied LMTP transactions in which the\n final DATA or BDAT command is pipelined after a failing RCPT command.\n - login-proxy: The login_source_ips setting has no effect, and therefore\n the proxy source IPs are not cycled through as they should be.\n - master: Process was using 100% CPU in some situations when a broken\n service was being throttled.\n - pop3-login: POP3 login would fail with \"Input buffer full\" if the\n initial response for SASL was too long.\n - stats: Crash would occur when generating openmetrics data for metrics\n using aggregating functions.\n\n Update pigeonhole to version 0.5.15\n\n * CVE-2020-28200: Sieve interpreter is not protected against abusive\n scripts that claim excessive resource usage. Fixed by limiting the user\n CPU time per single script execution and cumulatively over several\n script runs within a configurable timeout period. Sufficiently large CPU\n time usage is summed in the Sieve script binary and execution is blocked\n when the sum exceeds the limit within that time. The block is lifted\n when the script is updated after the resource usage times out.\n (bsc#1187420) Attacker can DoS the mail delivery system (jsc#PM-2746)\n ECO: Dovecot 2.3.15 version upgrade\n * Disconnection log messages are now more standardized across services.\n They also always now start with \"Disconnected\" prefix.\n * managesieve: Commands pipelined together with and just after the\n authenticate command cause these commands to be executed twice.\n * duplicate: The test was handled badly in a multiscript (sieve_before,\n sieve_after) scenario in which an earlier script in the sequence with a\n duplicate test succeeded, while a later script caused a runtime failure.\n In that case, the message is recorded for duplicate tracking, while the\n message may not actually have been delivered in the end.\n * editheader: Sieve interpreter entered infinite loop at startup when the\n \"editheader\" configuration listed an invalid header name. This problem\n can only be triggered by the administrator.\n * relational: The Sieve relational extension can cause a segfault at\n compile time. This is triggered by invalid script syntax. The segfault\n happens when this match type is the last argument of the test command.\n This situation is not possible in a valid script; positional arguments\n are normally present after that, which would prevent the segfault.\n * sieve: For some Sieve commands the provided mailbox name is not properly\n checked for UTF-8 validity, which can cause assert crashes at runtime\n when an invalid mailbox name is encountered. This can be caused by the\n user by writing a bad Sieve script involving the affected commands\n (\"mailboxexists\", \"specialuse_exists\"). This can be triggered by the\n remote sender only when the user has written a Sieve script that passes\n message content to one of the affected commands.\n * sieve: Large sequences of 8-bit octets passed to certain Sieve commands\n that create or modify message headers that allow UTF-8 text (vacation,\n notify and addheader) can cause the delivery or IMAP process (when\n IMAPSieve is used) to enter a memory-consuming semi-infinite loop that\n ends when the process exceeds its memory limits. Logged in users can\n cause these hangs only for their own processes.\n\n\nPatch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended installation methods\n like YaST online_update or \"zypper patch\".\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.3:\n\n zypper in -t patch openSUSE-SLE-15.3-2021-2892=1", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-09-01T00:00:00", "type": "suse", "title": "Security update for dovecot23 (moderate)", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-12100", "CVE-2020-24386", "CVE-2020-28200", "CVE-2021-29157", "CVE-2021-33515"], "modified": "2021-09-01T00:00:00", "id": "OPENSUSE-SU-2021:2892-1", "href": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YLFYZS4WAYE6TU4PO3V2JUI7DPQEK73I/", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "nessus": [{"lastseen": "2023-05-18T14:40:03", "description": "The remote host is affected by the vulnerability described in GLSA-202107-41 (Dovecot: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Dovecot. Please review the CVE identifiers referenced below for details.\n Impact :\n\n Please review the referenced CVE identifiers for details.\n Workaround :\n\n There is no known workaround at this time.", "cvss3": {}, "published": "2022-01-24T00:00:00", "type": "nessus", "title": "GLSA-202107-41 : Dovecot: Multiple vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-29157", "CVE-2021-33515"], "modified": "2022-05-09T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:dovecot", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-202107-41.NASL", "href": "https://www.tenable.com/plugins/nessus/157022", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 202107-41.\n#\n# The advisory text is Copyright (C) 2001-2022 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(157022);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/09\");\n\n script_cve_id(\"CVE-2021-29157\", \"CVE-2021-33515\");\n script_xref(name:\"GLSA\", value:\"202107-41\");\n\n script_name(english:\"GLSA-202107-41 : Dovecot: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"The remote host is affected by the vulnerability described in GLSA-202107-41\n(Dovecot: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Dovecot. Please review\n the CVE identifiers referenced below for details.\n \nImpact :\n\n Please review the referenced CVE identifiers for details.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/202107-41\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"All Dovecot users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-mail/dovecot-2.3.14.1'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-33515\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:dovecot\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/06/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/07/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/01/24\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"net-mail/dovecot\", unaffected:make_list(\"ge 2.3.14.1\"), vulnerable:make_list(\"lt 2.3.14.1\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Dovecot\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-20T14:58:11", "description": "The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1225-1 advisory.\n\n - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension. (CVE-2020-28200)\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-09-04T00:00:00", "type": "nessus", "title": "openSUSE 15 Security Update : dovecot23 (openSUSE-SU-2021:1225-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-28200", "CVE-2021-29157"], "modified": "2021-09-04T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:dovecot23", "p-cpe:/a:novell:opensuse:dovecot23-backend-mysql", "p-cpe:/a:novell:opensuse:dovecot23-backend-pgsql", "p-cpe:/a:novell:opensuse:dovecot23-backend-sqlite", "p-cpe:/a:novell:opensuse:dovecot23-devel", "p-cpe:/a:novell:opensuse:dovecot23-fts", "p-cpe:/a:novell:opensuse:dovecot23-fts-lucene", "p-cpe:/a:novell:opensuse:dovecot23-fts-solr", "p-cpe:/a:novell:opensuse:dovecot23-fts-squat", "cpe:/o:novell:opensuse:15.2"], "id": "OPENSUSE-2021-1225.NASL", "href": "https://www.tenable.com/plugins/nessus/153005", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# openSUSE Security Update openSUSE-SU-2021:1225-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(153005);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/09/04\");\n\n script_cve_id(\"CVE-2020-28200\", \"CVE-2021-29157\");\n\n script_name(english:\"openSUSE 15 Security Update : dovecot23 (openSUSE-SU-2021:1225-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in\nthe openSUSE-SU-2021:1225-1 advisory.\n\n - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a\n situation with a complex regular expression for the regex extension. (CVE-2020-28200)\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick\n OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs\n during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187418\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187419\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187420\");\n # https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IOZSH4SD3B27NBLCL3T2IO4EVB6AMFYQ/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?a99367f6\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-28200\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-29157\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-29157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/06/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/09/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/09/04\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-backend-mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-backend-pgsql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-backend-sqlite\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-fts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-fts-lucene\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-fts-solr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-fts-squat\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.2\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar release = get_kb_item('Host/SuSE/release');\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, 'openSUSE');\nvar os_ver = pregmatch(pattern: \"^SUSE([\\d.]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');\nos_ver = os_ver[1];\nif (release !~ \"^(SUSE15\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '15.2', release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + os_ver, cpu);\n\nvar pkgs = [\n {'reference':'dovecot23-2.3.15-lp152.2.12.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-backend-mysql-2.3.15-lp152.2.12.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-backend-pgsql-2.3.15-lp152.2.12.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-backend-sqlite-2.3.15-lp152.2.12.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-devel-2.3.15-lp152.2.12.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-fts-2.3.15-lp152.2.12.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-fts-lucene-2.3.15-lp152.2.12.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-fts-solr-2.3.15-lp152.2.12.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-fts-squat-2.3.15-lp152.2.12.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE}\n];\n\nvar flag = 0;\nforeach package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var cpu = NULL;\n var rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && release) {\n if (rpm_check(release:release, cpu:cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dovecot23 / dovecot23-backend-mysql / dovecot23-backend-pgsql / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:32:24", "description": "The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2892-1 advisory.\n\n - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension. (CVE-2020-28200)\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-09-01T00:00:00", "type": "nessus", "title": "openSUSE 15 Security Update : dovecot23 (openSUSE-SU-2021:2892-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-28200", "CVE-2021-29157"], "modified": "2021-09-01T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:dovecot23", "p-cpe:/a:novell:opensuse:dovecot23-backend-mysql", "p-cpe:/a:novell:opensuse:dovecot23-backend-pgsql", "p-cpe:/a:novell:opensuse:dovecot23-backend-sqlite", "p-cpe:/a:novell:opensuse:dovecot23-devel", "p-cpe:/a:novell:opensuse:dovecot23-fts", "p-cpe:/a:novell:opensuse:dovecot23-fts-lucene", "p-cpe:/a:novell:opensuse:dovecot23-fts-solr", "p-cpe:/a:novell:opensuse:dovecot23-fts-squat", "cpe:/o:novell:opensuse:15.3"], "id": "OPENSUSE-2021-2892.NASL", "href": "https://www.tenable.com/plugins/nessus/152941", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# openSUSE Security Update openSUSE-SU-2021:2892-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(152941);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/09/01\");\n\n script_cve_id(\"CVE-2020-28200\", \"CVE-2021-29157\");\n\n script_name(english:\"openSUSE 15 Security Update : dovecot23 (openSUSE-SU-2021:2892-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in\nthe openSUSE-SU-2021:2892-1 advisory.\n\n - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a\n situation with a complex regular expression for the regex extension. (CVE-2020-28200)\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick\n OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs\n during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187418\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187419\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187420\");\n # https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YLFYZS4WAYE6TU4PO3V2JUI7DPQEK73I/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?dc265a26\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-28200\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-29157\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-29157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/06/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/08/31\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/09/01\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-backend-mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-backend-pgsql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-backend-sqlite\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-fts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-fts-lucene\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-fts-solr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-fts-squat\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.3\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar release = get_kb_item('Host/SuSE/release');\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, 'openSUSE');\nvar os_ver = pregmatch(pattern: \"^SUSE([\\d.]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');\nos_ver = os_ver[1];\nif (release !~ \"^(SUSE15\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '15.3', release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + os_ver, cpu);\n\nvar pkgs = [\n {'reference':'dovecot23-2.3.15-58.3', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-backend-mysql-2.3.15-58.3', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-backend-pgsql-2.3.15-58.3', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-backend-sqlite-2.3.15-58.3', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-devel-2.3.15-58.3', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-fts-2.3.15-58.3', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-fts-lucene-2.3.15-58.3', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-fts-solr-2.3.15-58.3', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-fts-squat-2.3.15-58.3', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE}\n];\n\nvar flag = 0;\nforeach package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var cpu = NULL;\n var rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && release) {\n if (rpm_check(release:release, cpu:cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dovecot23 / dovecot23-backend-mysql / dovecot23-backend-pgsql / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-14T14:26:05", "description": "The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2123-1 advisory.\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\n - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address. (CVE-2021-33515)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-06-28T00:00:00", "type": "nessus", "title": "SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2123-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-29157", "CVE-2021-33515"], "modified": "2023-07-13T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:dovecot23", "p-cpe:/a:novell:suse_linux:dovecot23-backend-mysql", "p-cpe:/a:novell:suse_linux:dovecot23-backend-pgsql", "p-cpe:/a:novell:suse_linux:dovecot23-backend-sqlite", "p-cpe:/a:novell:suse_linux:dovecot23-devel", "p-cpe:/a:novell:suse_linux:dovecot23-fts", "p-cpe:/a:novell:suse_linux:dovecot23-fts-lucene", "p-cpe:/a:novell:suse_linux:dovecot23-fts-solr", "p-cpe:/a:novell:suse_linux:dovecot23-fts-squat", "cpe:/o:novell:suse_linux:15"], "id": "SUSE_SU-2021-2123-1.NASL", "href": "https://www.tenable.com/plugins/nessus/151094", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were extracted from\n# SUSE update advisory SUSE-SU-2021:2123-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(151094);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/07/13\");\n\n script_cve_id(\"CVE-2021-29157\", \"CVE-2021-33515\");\n script_xref(name:\"SuSE\", value:\"SUSE-SU-2021:2123-1\");\n\n script_name(english:\"SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2123-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in\nthe SUSE-SU-2021:2123-1 advisory.\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick\n OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs\n during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\n - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive\n information can be redirected to an attacker-controlled address. (CVE-2021-33515)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187418\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187419\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-29157\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-33515\");\n # https://lists.suse.com/pipermail/sle-security-updates/2021-June/009072.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?bba73a0e\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-33515\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-29157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/06/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/06/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/06/28\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-pgsql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-sqlite\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-lucene\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-solr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-squat\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item(\"Host/SuSE/release\");\nif (isnull(os_release) || os_release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nvar os_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLES15', 'SUSE (' + os_ver + ')');\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE (' + os_ver + ')', cpu);\n\nvar service_pack = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(service_pack)) service_pack = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(2|3)$\", string:service_pack))) audit(AUDIT_OS_NOT, \"SLES15 SP2/3\", os_ver + \" SP\" + service_pack);\n\nvar pkgs = [\n {'reference':'dovecot23-2.3.11.3-55.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-backend-mysql-2.3.11.3-55.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-backend-pgsql-2.3.11.3-55.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-backend-sqlite-2.3.11.3-55.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-devel-2.3.11.3-55.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-fts-2.3.11.3-55.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-fts-lucene-2.3.11.3-55.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-fts-solr-2.3.11.3-55.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-fts-squat-2.3.11.3-55.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-2.3.11.3-55.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']},\n {'reference':'dovecot23-backend-mysql-2.3.11.3-55.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']},\n {'reference':'dovecot23-backend-pgsql-2.3.11.3-55.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']},\n {'reference':'dovecot23-backend-sqlite-2.3.11.3-55.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']},\n {'reference':'dovecot23-devel-2.3.11.3-55.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']},\n {'reference':'dovecot23-fts-2.3.11.3-55.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']},\n {'reference':'dovecot23-fts-lucene-2.3.11.3-55.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']},\n {'reference':'dovecot23-fts-solr-2.3.11.3-55.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']},\n {'reference':'dovecot23-fts-squat-2.3.11.3-55.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']}\n];\n\nvar ltss_caveat_required = FALSE;\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var exists_check = NULL;\n var rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && _release) {\n if (exists_check) {\n var check_flag = 0;\n foreach var check (exists_check) {\n if (!rpm_exists(release:_release, rpm:check)) continue;\n check_flag++;\n }\n if (!check_flag) continue;\n }\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dovecot23 / dovecot23-backend-mysql / dovecot23-backend-pgsql / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-14T14:30:48", "description": "The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2890-1 advisory.\n\n - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension. (CVE-2020-28200)\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-09-01T00:00:00", "type": "nessus", "title": "SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2890-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-28200", "CVE-2021-29157"], "modified": "2023-07-13T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:dovecot23", "p-cpe:/a:novell:suse_linux:dovecot23-backend-mysql", "p-cpe:/a:novell:suse_linux:dovecot23-backend-pgsql", "p-cpe:/a:novell:suse_linux:dovecot23-backend-sqlite", "p-cpe:/a:novell:suse_linux:dovecot23-devel", "p-cpe:/a:novell:suse_linux:dovecot23-fts", "p-cpe:/a:novell:suse_linux:dovecot23-fts-lucene", "p-cpe:/a:novell:suse_linux:dovecot23-fts-solr", "p-cpe:/a:novell:suse_linux:dovecot23-fts-squat", "cpe:/o:novell:suse_linux:15"], "id": "SUSE_SU-2021-2890-1.NASL", "href": "https://www.tenable.com/plugins/nessus/152945", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were extracted from\n# SUSE update advisory SUSE-SU-2021:2890-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(152945);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/07/13\");\n\n script_cve_id(\"CVE-2020-28200\", \"CVE-2021-29157\");\n script_xref(name:\"SuSE\", value:\"SUSE-SU-2021:2890-1\");\n\n script_name(english:\"SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2890-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the SUSE-SU-2021:2890-1 advisory.\n\n - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a\n situation with a complex regular expression for the regex extension. (CVE-2020-28200)\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick\n OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs\n during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187418\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187419\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187420\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-28200\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-29157\");\n # https://lists.suse.com/pipermail/sle-security-updates/2021-August/009373.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?8e1d37d9\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-29157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/06/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/08/31\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/09/01\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-pgsql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-sqlite\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-lucene\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-solr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-squat\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item(\"Host/SuSE/release\");\nif (isnull(os_release) || os_release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nvar os_ver = pregmatch(pattern: \"^(SLE(S|D)(?:_SAP)?\\d+)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES15|SLES_SAP15)$\", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLES15 / SLES_SAP15', 'SUSE (' + os_ver + ')');\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE (' + os_ver + ')', cpu);\n\nvar service_pack = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(service_pack)) service_pack = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(0)$\", string:service_pack))) audit(AUDIT_OS_NOT, \"SLES15 SP0\", os_ver + \" SP\" + service_pack);\nif (os_ver == \"SLES_SAP15\" && (! preg(pattern:\"^(0)$\", string:service_pack))) audit(AUDIT_OS_NOT, \"SLES_SAP15 SP0\", os_ver + \" SP\" + service_pack);\n\nvar pkgs = [\n {'reference':'dovecot23-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-backend-mysql-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-backend-pgsql-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-backend-sqlite-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-devel-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-fts-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-fts-lucene-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-fts-solr-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-fts-squat-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-mysql-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-mysql-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-mysql-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-mysql-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-pgsql-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-pgsql-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-pgsql-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-pgsql-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-sqlite-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-sqlite-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-sqlite-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-sqlite-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-devel-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-devel-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-devel-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-devel-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-lucene-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-lucene-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-lucene-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-lucene-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-solr-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-solr-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-solr-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-solr-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-squat-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-squat-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-squat-2.3.15-4.38.3', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-squat-2.3.15-4.38.3', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-2.3.15-4.38.3', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']},\n {'reference':'dovecot23-backend-mysql-2.3.15-4.38.3', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']},\n {'reference':'dovecot23-backend-pgsql-2.3.15-4.38.3', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']},\n {'reference':'dovecot23-backend-sqlite-2.3.15-4.38.3', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']},\n {'reference':'dovecot23-devel-2.3.15-4.38.3', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']},\n {'reference':'dovecot23-fts-2.3.15-4.38.3', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']},\n {'reference':'dovecot23-fts-lucene-2.3.15-4.38.3', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']},\n {'reference':'dovecot23-fts-solr-2.3.15-4.38.3', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']},\n {'reference':'dovecot23-fts-squat-2.3.15-4.38.3', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']}\n];\n\nvar ltss_caveat_required = FALSE;\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var exists_check = NULL;\n var rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && _release) {\n if (exists_check) {\n var check_flag = 0;\n foreach var check (exists_check) {\n if (!rpm_exists(release:_release, rpm:check)) continue;\n if ('ltss' >< tolower(check)) ltss_caveat_required = TRUE;\n check_flag++;\n }\n if (!check_flag) continue;\n }\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n var ltss_plugin_caveat = NULL;\n if(ltss_caveat_required) ltss_plugin_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in SUSE Enterprise Linux Server LTSS\\n' +\n 'repositories. Access to these package security updates require\\n' +\n 'a paid SUSE LTSS subscription.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : rpm_report_get() + ltss_plugin_caveat\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dovecot23 / dovecot23-backend-mysql / dovecot23-backend-pgsql / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:30:46", "description": "Dovecot team reports :\n\nCVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens in some configurations. This requires attacker to be able to write files to local disk.\n\nCVE-2021-33515: On-path attacker could inject plaintext commands before STARTTLS negotiation that would be executed after STARTTLS finished with the client. Only the SMTP submission service is affected.", "cvss3": {}, "published": "2021-06-25T00:00:00", "type": "nessus", "title": "FreeBSD : dovecot -- multiple vulnerabilities (d18f431d-d360-11eb-a32c-00a0989e4ec1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-29157", "CVE-2021-33515"], "modified": "2022-05-09T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:dovecot", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_D18F431DD36011EBA32C00A0989E4EC1.NASL", "href": "https://www.tenable.com/plugins/nessus/151003", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2021 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(151003);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/09\");\n\n script_cve_id(\"CVE-2021-29157\", \"CVE-2021-33515\");\n\n script_name(english:\"FreeBSD : dovecot -- multiple vulnerabilities (d18f431d-d360-11eb-a32c-00a0989e4ec1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote FreeBSD host is missing a security-related update.\");\n script_set_attribute(attribute:\"description\", value:\n\"Dovecot team reports :\n\nCVE-2021-29157: Dovecot does not correctly escape kid and azp fields\nin JWT tokens. This may be used to supply attacker controlled keys to\nvalidate tokens in some configurations. This requires attacker to be\nable to write files to local disk.\n\nCVE-2021-33515: On-path attacker could inject plaintext commands\nbefore STARTTLS negotiation that would be executed after STARTTLS\nfinished with the client. Only the SMTP submission service is\naffected.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://dovecot.org/pipermail/dovecot-news/2021-June/000461.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://dovecot.org/pipermail/dovecot-news/2021-June/000462.html\");\n # https://vuxml.freebsd.org/freebsd/d18f431d-d360-11eb-a32c-00a0989e4ec1.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?ab15b8a5\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-33515\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-29157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/03/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/06/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/06/25\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:dovecot\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"dovecot>=2.3.11<2.3.14.1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-14T14:31:06", "description": "The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2892-1 advisory.\n\n - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension. (CVE-2020-28200)\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-09-01T00:00:00", "type": "nessus", "title": "SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2892-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-28200", "CVE-2021-29157"], "modified": "2023-07-13T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:dovecot23", "p-cpe:/a:novell:suse_linux:dovecot23-backend-mysql", "p-cpe:/a:novell:suse_linux:dovecot23-backend-pgsql", "p-cpe:/a:novell:suse_linux:dovecot23-backend-sqlite", "p-cpe:/a:novell:suse_linux:dovecot23-devel", "p-cpe:/a:novell:suse_linux:dovecot23-fts", "p-cpe:/a:novell:suse_linux:dovecot23-fts-lucene", "p-cpe:/a:novell:suse_linux:dovecot23-fts-solr", "p-cpe:/a:novell:suse_linux:dovecot23-fts-squat", "cpe:/o:novell:suse_linux:15"], "id": "SUSE_SU-2021-2892-1.NASL", "href": "https://www.tenable.com/plugins/nessus/152944", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were extracted from\n# SUSE update advisory SUSE-SU-2021:2892-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(152944);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/07/13\");\n\n script_cve_id(\"CVE-2020-28200\", \"CVE-2021-29157\");\n script_xref(name:\"SuSE\", value:\"SUSE-SU-2021:2892-1\");\n\n script_name(english:\"SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2892-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in\nthe SUSE-SU-2021:2892-1 advisory.\n\n - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a\n situation with a complex regular expression for the regex extension. (CVE-2020-28200)\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick\n OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs\n during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187418\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187419\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187420\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-28200\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-29157\");\n # https://lists.suse.com/pipermail/sle-security-updates/2021-August/009374.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?be579a44\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-29157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/06/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/08/31\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/09/01\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-pgsql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-sqlite\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-lucene\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-solr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-squat\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item(\"Host/SuSE/release\");\nif (isnull(os_release) || os_release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nvar os_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLES15', 'SUSE (' + os_ver + ')');\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE (' + os_ver + ')', cpu);\n\nvar service_pack = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(service_pack)) service_pack = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(2|3)$\", string:service_pack))) audit(AUDIT_OS_NOT, \"SLES15 SP2/3\", os_ver + \" SP\" + service_pack);\n\nvar pkgs = [\n {'reference':'dovecot23-2.3.15-58.3', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-backend-mysql-2.3.15-58.3', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-backend-pgsql-2.3.15-58.3', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-backend-sqlite-2.3.15-58.3', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-devel-2.3.15-58.3', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-fts-2.3.15-58.3', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-fts-lucene-2.3.15-58.3', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-fts-solr-2.3.15-58.3', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-fts-squat-2.3.15-58.3', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.2']},\n {'reference':'dovecot23-2.3.15-58.3', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']},\n {'reference':'dovecot23-backend-mysql-2.3.15-58.3', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']},\n {'reference':'dovecot23-backend-pgsql-2.3.15-58.3', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']},\n {'reference':'dovecot23-backend-sqlite-2.3.15-58.3', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']},\n {'reference':'dovecot23-devel-2.3.15-58.3', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']},\n {'reference':'dovecot23-fts-2.3.15-58.3', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']},\n {'reference':'dovecot23-fts-lucene-2.3.15-58.3', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']},\n {'reference':'dovecot23-fts-solr-2.3.15-58.3', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']},\n {'reference':'dovecot23-fts-squat-2.3.15-58.3', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-server-applications-release-15.3']}\n];\n\nvar ltss_caveat_required = FALSE;\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var exists_check = NULL;\n var rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && _release) {\n if (exists_check) {\n var check_flag = 0;\n foreach var check (exists_check) {\n if (!rpm_exists(release:_release, rpm:check)) continue;\n check_flag++;\n }\n if (!check_flag) continue;\n }\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dovecot23 / dovecot23-backend-mysql / dovecot23-backend-pgsql / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-14T14:34:03", "description": "The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2891-1 advisory.\n\n - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension. (CVE-2020-28200)\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-09-01T00:00:00", "type": "nessus", "title": "SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2891-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-28200", "CVE-2021-29157"], "modified": "2023-07-13T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:dovecot23", "p-cpe:/a:novell:suse_linux:dovecot23-backend-mysql", "p-cpe:/a:novell:suse_linux:dovecot23-backend-pgsql", "p-cpe:/a:novell:suse_linux:dovecot23-backend-sqlite", "p-cpe:/a:novell:suse_linux:dovecot23-devel", "p-cpe:/a:novell:suse_linux:dovecot23-fts", "p-cpe:/a:novell:suse_linux:dovecot23-fts-lucene", "p-cpe:/a:novell:suse_linux:dovecot23-fts-solr", "p-cpe:/a:novell:suse_linux:dovecot23-fts-squat", "cpe:/o:novell:suse_linux:15"], "id": "SUSE_SU-2021-2891-1.NASL", "href": "https://www.tenable.com/plugins/nessus/152947", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were extracted from\n# SUSE update advisory SUSE-SU-2021:2891-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(152947);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/07/13\");\n\n script_cve_id(\"CVE-2020-28200\", \"CVE-2021-29157\");\n script_xref(name:\"SuSE\", value:\"SUSE-SU-2021:2891-1\");\n\n script_name(english:\"SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2891-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the SUSE-SU-2021:2891-1 advisory.\n\n - The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a\n situation with a complex regular expression for the regex extension. (CVE-2020-28200)\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick\n OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs\n during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187418\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187419\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187420\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-28200\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-29157\");\n # https://lists.suse.com/pipermail/sle-security-updates/2021-August/009375.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?7f4a651b\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-29157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/06/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/08/31\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/09/01\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-pgsql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-sqlite\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-lucene\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-solr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-squat\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item(\"Host/SuSE/release\");\nif (isnull(os_release) || os_release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nvar os_ver = pregmatch(pattern: \"^(SLE(S|D)(?:_SAP)?\\d+)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES15|SLES_SAP15)$\", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLES15 / SLES_SAP15', 'SUSE (' + os_ver + ')');\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE (' + os_ver + ')', cpu);\n\nvar service_pack = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(service_pack)) service_pack = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(1)$\", string:service_pack))) audit(AUDIT_OS_NOT, \"SLES15 SP1\", os_ver + \" SP\" + service_pack);\nif (os_ver == \"SLES_SAP15\" && (! preg(pattern:\"^(1)$\", string:service_pack))) audit(AUDIT_OS_NOT, \"SLES_SAP15 SP1\", os_ver + \" SP\" + service_pack);\n\nvar pkgs = [\n {'reference':'dovecot23-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-backend-mysql-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-backend-pgsql-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-backend-sqlite-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-devel-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-fts-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-fts-lucene-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-fts-solr-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-fts-squat-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-backend-mysql-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-backend-mysql-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-backend-pgsql-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-backend-pgsql-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-backend-sqlite-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-backend-sqlite-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-devel-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-devel-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-fts-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-fts-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-fts-lucene-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-fts-lucene-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-fts-solr-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-fts-solr-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-fts-squat-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-fts-squat-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-backend-mysql-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-backend-mysql-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-backend-pgsql-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-backend-pgsql-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-backend-sqlite-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-backend-sqlite-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-devel-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-devel-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-fts-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-fts-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-fts-lucene-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-fts-lucene-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-fts-solr-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-fts-solr-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-fts-squat-2.3.15-27.3', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-fts-squat-2.3.15-27.3', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-2.3.15-27.3', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},\n {'reference':'dovecot23-backend-mysql-2.3.15-27.3', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},\n {'reference':'dovecot23-backend-pgsql-2.3.15-27.3', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},\n {'reference':'dovecot23-backend-sqlite-2.3.15-27.3', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},\n {'reference':'dovecot23-devel-2.3.15-27.3', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},\n {'reference':'dovecot23-fts-2.3.15-27.3', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},\n {'reference':'dovecot23-fts-lucene-2.3.15-27.3', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},\n {'reference':'dovecot23-fts-solr-2.3.15-27.3', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},\n {'reference':'dovecot23-fts-squat-2.3.15-27.3', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']}\n];\n\nvar ltss_caveat_required = FALSE;\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var exists_check = NULL;\n var rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && _release) {\n if (exists_check) {\n var check_flag = 0;\n foreach var check (exists_check) {\n if (!rpm_exists(release:_release, rpm:check)) continue;\n if ('ltss' >< tolower(check)) ltss_caveat_required = TRUE;\n check_flag++;\n }\n if (!check_flag) continue;\n }\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n var ltss_plugin_caveat = NULL;\n if(ltss_caveat_required) ltss_plugin_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in SUSE Enterprise Linux Server LTSS\\n' +\n 'repositories. Access to these package security updates require\\n' +\n 'a paid SUSE LTSS subscription.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : rpm_report_get() + ltss_plugin_caveat\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dovecot23 / dovecot23-backend-mysql / dovecot23-backend-pgsql / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-15T18:29:59", "description": "The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2124-1 advisory.\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\n - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address. (CVE-2021-33515)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-06-28T00:00:00", "type": "nessus", "title": "SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2124-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-29157", "CVE-2021-33515"], "modified": "2023-07-13T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:dovecot23", "p-cpe:/a:novell:suse_linux:dovecot23-backend-mysql", "p-cpe:/a:novell:suse_linux:dovecot23-backend-pgsql", "p-cpe:/a:novell:suse_linux:dovecot23-backend-sqlite", "p-cpe:/a:novell:suse_linux:dovecot23-devel", "p-cpe:/a:novell:suse_linux:dovecot23-fts", "p-cpe:/a:novell:suse_linux:dovecot23-fts-lucene", "p-cpe:/a:novell:suse_linux:dovecot23-fts-solr", "p-cpe:/a:novell:suse_linux:dovecot23-fts-squat", "cpe:/o:novell:suse_linux:15"], "id": "SUSE_SU-2021-2124-1.NASL", "href": "https://www.tenable.com/plugins/nessus/151106", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were extracted from\n# SUSE update advisory SUSE-SU-2021:2124-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(151106);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/07/13\");\n\n script_cve_id(\"CVE-2021-29157\", \"CVE-2021-33515\");\n script_xref(name:\"SuSE\", value:\"SUSE-SU-2021:2124-1\");\n\n script_name(english:\"SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2124-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the SUSE-SU-2021:2124-1 advisory.\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick\n OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs\n during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\n - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive\n information can be redirected to an attacker-controlled address. (CVE-2021-33515)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187418\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187419\");\n script_set_attribute(attribute:\"see_also\", value:\"https://lists.suse.com/pipermail/sle-updates/2021-June/019410.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-29157\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-33515\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-33515\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-29157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/06/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/06/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/06/28\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-pgsql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-sqlite\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-lucene\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-solr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-squat\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item(\"Host/SuSE/release\");\nif (isnull(os_release) || os_release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nvar os_ver = pregmatch(pattern: \"^(SLE(S|D)(?:_SAP)?\\d+)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES15|SLES_SAP15)$\", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLES15 / SLES_SAP15', 'SUSE (' + os_ver + ')');\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE (' + os_ver + ')', cpu);\n\nvar service_pack = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(service_pack)) service_pack = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(1)$\", string:service_pack))) audit(AUDIT_OS_NOT, \"SLES15 SP1\", os_ver + \" SP\" + service_pack);\nif (os_ver == \"SLES_SAP15\" && (! preg(pattern:\"^(1)$\", string:service_pack))) audit(AUDIT_OS_NOT, \"SLES_SAP15 SP1\", os_ver + \" SP\" + service_pack);\n\nvar pkgs = [\n {'reference':'dovecot23-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-backend-mysql-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-backend-pgsql-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-backend-sqlite-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-devel-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-fts-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-fts-lucene-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-fts-solr-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-fts-squat-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},\n {'reference':'dovecot23-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-backend-mysql-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-backend-mysql-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-backend-pgsql-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-backend-pgsql-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-backend-sqlite-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-backend-sqlite-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-devel-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-devel-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-fts-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-fts-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-fts-lucene-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-fts-lucene-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-fts-solr-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-fts-solr-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-fts-squat-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1']},\n {'reference':'dovecot23-fts-squat-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-1', 'sles-release-15.1']},\n {'reference':'dovecot23-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-backend-mysql-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-backend-mysql-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-backend-pgsql-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-backend-pgsql-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-backend-sqlite-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-backend-sqlite-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-devel-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-devel-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-fts-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-fts-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-fts-lucene-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-fts-lucene-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-fts-solr-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-fts-solr-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-fts-squat-2.3.11.3-24.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-fts-squat-2.3.11.3-24.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},\n {'reference':'dovecot23-2.3.11.3-24.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},\n {'reference':'dovecot23-backend-mysql-2.3.11.3-24.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},\n {'reference':'dovecot23-backend-pgsql-2.3.11.3-24.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},\n {'reference':'dovecot23-backend-sqlite-2.3.11.3-24.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},\n {'reference':'dovecot23-devel-2.3.11.3-24.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},\n {'reference':'dovecot23-fts-2.3.11.3-24.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},\n {'reference':'dovecot23-fts-lucene-2.3.11.3-24.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},\n {'reference':'dovecot23-fts-solr-2.3.11.3-24.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},\n {'reference':'dovecot23-fts-squat-2.3.11.3-24.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']}\n];\n\nvar ltss_caveat_required = FALSE;\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var exists_check = NULL;\n var rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && _release) {\n if (exists_check) {\n var check_flag = 0;\n foreach var check (exists_check) {\n if (!rpm_exists(release:_release, rpm:check)) continue;\n if ('ltss' >< tolower(check)) ltss_caveat_required = TRUE;\n check_flag++;\n }\n if (!check_flag) continue;\n }\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n var ltss_plugin_caveat = NULL;\n if(ltss_caveat_required) ltss_plugin_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in SUSE Enterprise Linux Server LTSS\\n' +\n 'repositories. Access to these package security updates require\\n' +\n 'a paid SUSE LTSS subscription.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + ltss_plugin_caveat\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dovecot23 / dovecot23-backend-mysql / dovecot23-backend-pgsql / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:31:04", "description": "The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2123-1 advisory.\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\n - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address. (CVE-2021-33515)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-07-16T00:00:00", "type": "nessus", "title": "openSUSE 15 Security Update : dovecot23 (openSUSE-SU-2021:2123-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-29157", "CVE-2021-33515"], "modified": "2022-05-09T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:dovecot23", "p-cpe:/a:novell:opensuse:dovecot23-backend-mysql", "p-cpe:/a:novell:opensuse:dovecot23-backend-pgsql", "p-cpe:/a:novell:opensuse:dovecot23-backend-sqlite", "p-cpe:/a:novell:opensuse:dovecot23-devel", "p-cpe:/a:novell:opensuse:dovecot23-fts", "p-cpe:/a:novell:opensuse:dovecot23-fts-lucene", "p-cpe:/a:novell:opensuse:dovecot23-fts-solr", "p-cpe:/a:novell:opensuse:dovecot23-fts-squat", "cpe:/o:novell:opensuse:15.3"], "id": "OPENSUSE-2021-2123.NASL", "href": "https://www.tenable.com/plugins/nessus/151697", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# openSUSE Security Update openSUSE-SU-2021:2123-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(151697);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/09\");\n\n script_cve_id(\"CVE-2021-29157\", \"CVE-2021-33515\");\n\n script_name(english:\"openSUSE 15 Security Update : dovecot23 (openSUSE-SU-2021:2123-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in\nthe openSUSE-SU-2021:2123-1 advisory.\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick\n OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs\n during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\n - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive\n information can be redirected to an attacker-controlled address. (CVE-2021-33515)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187418\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187419\");\n # https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G567PZ5Z5XTMWM5HHQHCWSMCWQSOWCGA/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?f0ed43dd\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-29157\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-33515\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-33515\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-29157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/06/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/07/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/07/16\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-backend-mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-backend-pgsql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-backend-sqlite\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-fts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-fts-lucene\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-fts-solr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-fts-squat\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.3\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/SuSE/release');\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, 'openSUSE');\nos_ver = pregmatch(pattern: \"^SUSE([\\d.]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');\nos_ver = os_ver[1];\nif (release !~ \"^(SUSE15\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '15.3', release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + os_ver, cpu);\n\npkgs = [\n {'reference':'dovecot23-2.3.11.3-55.1', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-backend-mysql-2.3.11.3-55.1', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-backend-pgsql-2.3.11.3-55.1', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-backend-sqlite-2.3.11.3-55.1', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-devel-2.3.11.3-55.1', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-fts-2.3.11.3-55.1', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-fts-lucene-2.3.11.3-55.1', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-fts-solr-2.3.11.3-55.1', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-fts-squat-2.3.11.3-55.1', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n cpu = NULL;\n rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && release) {\n if (rpm_check(release:release, cpu:cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dovecot23 / dovecot23-backend-mysql / dovecot23-backend-pgsql / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:29:55", "description": "The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:0920-1 advisory.\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\n - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address. (CVE-2021-33515)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-06-28T00:00:00", "type": "nessus", "title": "openSUSE 15 Security Update : dovecot23 (openSUSE-SU-2021:0920-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-29157", "CVE-2021-33515"], "modified": "2022-05-09T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:dovecot23", "p-cpe:/a:novell:opensuse:dovecot23-backend-mysql", "p-cpe:/a:novell:opensuse:dovecot23-backend-pgsql", "p-cpe:/a:novell:opensuse:dovecot23-backend-sqlite", "p-cpe:/a:novell:opensuse:dovecot23-devel", "p-cpe:/a:novell:opensuse:dovecot23-fts", "p-cpe:/a:novell:opensuse:dovecot23-fts-lucene", "p-cpe:/a:novell:opensuse:dovecot23-fts-solr", "p-cpe:/a:novell:opensuse:dovecot23-fts-squat", "cpe:/o:novell:opensuse:15.2"], "id": "OPENSUSE-2021-920.NASL", "href": "https://www.tenable.com/plugins/nessus/151056", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# openSUSE Security Update openSUSE-SU-2021:0920-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(151056);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/09\");\n\n script_cve_id(\"CVE-2021-29157\", \"CVE-2021-33515\");\n\n script_name(english:\"openSUSE 15 Security Update : dovecot23 (openSUSE-SU-2021:0920-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in\nthe openSUSE-SU-2021:0920-1 advisory.\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick\n OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs\n during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\n - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive\n information can be redirected to an attacker-controlled address. (CVE-2021-33515)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187418\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187419\");\n # https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VRGETVIUWL6C53ONKOWQB6XMHGC4U2YM/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?eb0a3af9\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-29157\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-33515\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-33515\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-29157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/06/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/06/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/06/28\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-backend-mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-backend-pgsql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-backend-sqlite\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-fts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-fts-lucene\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-fts-solr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:dovecot23-fts-squat\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.2\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/SuSE/release');\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, 'openSUSE');\nos_ver = pregmatch(pattern: \"^SUSE([\\d.]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');\nos_ver = os_ver[1];\nif (release !~ \"^(SUSE15\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '15.2', release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + os_ver, cpu);\n\npkgs = [\n {'reference':'dovecot23-2.3.11.3-lp152.2.9.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-backend-mysql-2.3.11.3-lp152.2.9.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-backend-pgsql-2.3.11.3-lp152.2.9.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-backend-sqlite-2.3.11.3-lp152.2.9.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-devel-2.3.11.3-lp152.2.9.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-fts-2.3.11.3-lp152.2.9.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-fts-lucene-2.3.11.3-lp152.2.9.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-fts-solr-2.3.11.3-lp152.2.9.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'dovecot23-fts-squat-2.3.11.3-lp152.2.9.1', 'cpu':'x86_64', 'release':'SUSE15.2', 'rpm_spec_vers_cmp':TRUE}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n cpu = NULL;\n rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && release) {\n if (rpm_check(release:release, cpu:cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dovecot23 / dovecot23-backend-mysql / dovecot23-backend-pgsql / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:29:54", "description": "The remote Ubuntu 20.04 LTS / 20.10 / 21.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4993-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-06-21T00:00:00", "type": "nessus", "title": "Ubuntu 20.04 LTS / 20.10 / 21.04 : Dovecot vulnerabilities (USN-4993-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-29157", "CVE-2021-33515"], "modified": "2023-01-17T00:00:00", "cpe": ["cpe:/o:canonical:ubuntu_linux:21.04", "p-cpe:/a:canonical:ubuntu_linux:dovecot-sieve", "p-cpe:/a:canonical:ubuntu_linux:dovecot-sqlite", "p-cpe:/a:canonical:ubuntu_linux:mail-stack-delivery", "p-cpe:/a:canonical:ubuntu_linux:dovecot-dev", "p-cpe:/a:canonical:ubuntu_linux:dovecot-gssapi", "p-cpe:/a:canonical:ubuntu_linux:dovecot-imapd", "p-cpe:/a:canonical:ubuntu_linux:dovecot-pgsql", "p-cpe:/a:canonical:ubuntu_linux:dovecot-mysql", "p-cpe:/a:canonical:ubuntu_linux:dovecot-submissiond", "p-cpe:/a:canonical:ubuntu_linux:dovecot-auth-lua", "cpe:/o:canonical:ubuntu_linux:20.10", "p-cpe:/a:canonical:ubuntu_linux:dovecot-lucene", "p-cpe:/a:canonical:ubuntu_linux:dovecot-ldap", "p-cpe:/a:canonical:ubuntu_linux:dovecot-managesieved", "p-cpe:/a:canonical:ubuntu_linux:dovecot-core", "p-cpe:/a:canonical:ubuntu_linux:dovecot-pop3d", "p-cpe:/a:canonical:ubuntu_linux:dovecot-lmtpd", "p-cpe:/a:canonical:ubuntu_linux:dovecot-solr", "cpe:/o:canonical:ubuntu_linux:20.04:-:lts"], "id": "UBUNTU_USN-4993-1.NASL", "href": "https://www.tenable.com/plugins/nessus/150939", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4993-1. The text\n# itself is copyright (C) Canonical, Inc. See\n# <https://ubuntu.com/security/notices>. Ubuntu(R) is a registered\n# trademark of Canonical, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(150939);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/17\");\n\n script_cve_id(\"CVE-2021-29157\", \"CVE-2021-33515\");\n script_xref(name:\"USN\", value:\"4993-1\");\n\n script_name(english:\"Ubuntu 20.04 LTS / 20.10 / 21.04 : Dovecot vulnerabilities (USN-4993-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Ubuntu host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Ubuntu 20.04 LTS / 20.10 / 21.04 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the USN-4993-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the\napplication's self-reported version number.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://ubuntu.com/security/notices/USN-4993-1\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-33515\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-29157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/06/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/06/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/06/21\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:20.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:20.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:21.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dovecot-auth-lua\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dovecot-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dovecot-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dovecot-gssapi\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dovecot-imapd\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dovecot-ldap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dovecot-lmtpd\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dovecot-lucene\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dovecot-managesieved\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dovecot-mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dovecot-pgsql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dovecot-pop3d\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dovecot-sieve\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dovecot-solr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dovecot-sqlite\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:dovecot-submissiond\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:mail-stack-delivery\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_copyright(english:\"Ubuntu Security Notice (C) 2021-2023 Canonical, Inc. / NASL script (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('ubuntu.inc');\ninclude('misc_func.inc');\n\nif ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/Ubuntu/release');\nif ( isnull(release) ) audit(AUDIT_OS_NOT, 'Ubuntu');\nrelease = chomp(release);\nif (! preg(pattern:\"^(20\\.04|20\\.10|21\\.04)$\", string:release)) audit(AUDIT_OS_NOT, 'Ubuntu 20.04 / 20.10 / 21.04', 'Ubuntu ' + release);\nif ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\n\npkgs = [\n {'osver': '20.04', 'pkgname': 'dovecot-auth-lua', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.04', 'pkgname': 'dovecot-core', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.04', 'pkgname': 'dovecot-dev', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.04', 'pkgname': 'dovecot-gssapi', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.04', 'pkgname': 'dovecot-imapd', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.04', 'pkgname': 'dovecot-ldap', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.04', 'pkgname': 'dovecot-lmtpd', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.04', 'pkgname': 'dovecot-lucene', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.04', 'pkgname': 'dovecot-managesieved', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.04', 'pkgname': 'dovecot-mysql', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.04', 'pkgname': 'dovecot-pgsql', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.04', 'pkgname': 'dovecot-pop3d', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.04', 'pkgname': 'dovecot-sieve', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.04', 'pkgname': 'dovecot-solr', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.04', 'pkgname': 'dovecot-sqlite', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.04', 'pkgname': 'dovecot-submissiond', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.04', 'pkgname': 'mail-stack-delivery', 'pkgver': '1:2.3.7.2-1ubuntu3.4'},\n {'osver': '20.10', 'pkgname': 'dovecot-auth-lua', 'pkgver': '1:2.3.11.3+dfsg1-2ubuntu0.2'},\n {'osver': '20.10', 'pkgname': 'dovecot-core', 'pkgver': '1:2.3.11.3+dfsg1-2ubuntu0.2'},\n {'osver': '20.10', 'pkgname': 'dovecot-dev', 'pkgver': '1:2.3.11.3+dfsg1-2ubuntu0.2'},\n {'osver': '20.10', 'pkgname': 'dovecot-gssapi', 'pkgver': '1:2.3.11.3+dfsg1-2ubuntu0.2'},\n {'osver': '20.10', 'pkgname': 'dovecot-imapd', 'pkgver': '1:2.3.11.3+dfsg1-2ubuntu0.2'},\n {'osver': '20.10', 'pkgname': 'dovecot-ldap', 'pkgver': '1:2.3.11.3+dfsg1-2ubuntu0.2'},\n {'osver': '20.10', 'pkgname': 'dovecot-lmtpd', 'pkgver': '1:2.3.11.3+dfsg1-2ubuntu0.2'},\n {'osver': '20.10', 'pkgname': 'dovecot-lucene', 'pkgver': '1:2.3.11.3+dfsg1-2ubuntu0.2'},\n {'osver': '20.10', 'pkgname': 'dovecot-managesieved', 'pkgver': '1:2.3.11.3+dfsg1-2ubuntu0.2'},\n {'osver': '20.10', 'pkgname': 'dovecot-mysql', 'pkgver': '1:2.3.11.3+dfsg1-2ubuntu0.2'},\n {'osver': '20.10', 'pkgname': 'dovecot-pgsql', 'pkgver': '1:2.3.11.3+dfsg1-2ubuntu0.2'},\n {'osver': '20.10', 'pkgname': 'dovecot-pop3d', 'pkgver': '1:2.3.11.3+dfsg1-2ubuntu0.2'},\n {'osver': '20.10', 'pkgname': 'dovecot-sieve', 'pkgver': '1:2.3.11.3+dfsg1-2ubuntu0.2'},\n {'osver': '20.10', 'pkgname': 'dovecot-solr', 'pkgver': '1:2.3.11.3+dfsg1-2ubuntu0.2'},\n {'osver': '20.10', 'pkgname': 'dovecot-sqlite', 'pkgver': '1:2.3.11.3+dfsg1-2ubuntu0.2'},\n {'osver': '20.10', 'pkgname': 'dovecot-submissiond', 'pkgver': '1:2.3.11.3+dfsg1-2ubuntu0.2'},\n {'osver': '21.04', 'pkgname': 'dovecot-auth-lua', 'pkgver': '1:2.3.13+dfsg1-1ubuntu1.1'},\n {'osver': '21.04', 'pkgname': 'dovecot-core', 'pkgver': '1:2.3.13+dfsg1-1ubuntu1.1'},\n {'osver': '21.04', 'pkgname': 'dovecot-dev', 'pkgver': '1:2.3.13+dfsg1-1ubuntu1.1'},\n {'osver': '21.04', 'pkgname': 'dovecot-gssapi', 'pkgver': '1:2.3.13+dfsg1-1ubuntu1.1'},\n {'osver': '21.04', 'pkgname': 'dovecot-imapd', 'pkgver': '1:2.3.13+dfsg1-1ubuntu1.1'},\n {'osver': '21.04', 'pkgname': 'dovecot-ldap', 'pkgver': '1:2.3.13+dfsg1-1ubuntu1.1'},\n {'osver': '21.04', 'pkgname': 'dovecot-lmtpd', 'pkgver': '1:2.3.13+dfsg1-1ubuntu1.1'},\n {'osver': '21.04', 'pkgname': 'dovecot-lucene', 'pkgver': '1:2.3.13+dfsg1-1ubuntu1.1'},\n {'osver': '21.04', 'pkgname': 'dovecot-managesieved', 'pkgver': '1:2.3.13+dfsg1-1ubuntu1.1'},\n {'osver': '21.04', 'pkgname': 'dovecot-mysql', 'pkgver': '1:2.3.13+dfsg1-1ubuntu1.1'},\n {'osver': '21.04', 'pkgname': 'dovecot-pgsql', 'pkgver': '1:2.3.13+dfsg1-1ubuntu1.1'},\n {'osver': '21.04', 'pkgname': 'dovecot-pop3d', 'pkgver': '1:2.3.13+dfsg1-1ubuntu1.1'},\n {'osver': '21.04', 'pkgname': 'dovecot-sieve', 'pkgver': '1:2.3.13+dfsg1-1ubuntu1.1'},\n {'osver': '21.04', 'pkgname': 'dovecot-solr', 'pkgver': '1:2.3.13+dfsg1-1ubuntu1.1'},\n {'osver': '21.04', 'pkgname': 'dovecot-sqlite', 'pkgver': '1:2.3.13+dfsg1-1ubuntu1.1'},\n {'osver': '21.04', 'pkgname': 'dovecot-submissiond', 'pkgver': '1:2.3.13+dfsg1-1ubuntu1.1'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n osver = NULL;\n pkgname = NULL;\n pkgver = NULL;\n if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];\n if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];\n if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];\n if (osver && pkgname && pkgver) {\n if (ubuntu_check(osver:osver, pkgname:pkgname, pkgver:pkgver)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dovecot-auth-lua / dovecot-core / dovecot-dev / dovecot-gssapi / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-15T18:28:02", "description": "The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2122-1 advisory.\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\n - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address. (CVE-2021-33515)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-06-28T00:00:00", "type": "nessus", "title": "SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2122-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-29157", "CVE-2021-33515"], "modified": "2023-07-13T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:dovecot23", "p-cpe:/a:novell:suse_linux:dovecot23-backend-mysql", "p-cpe:/a:novell:suse_linux:dovecot23-backend-pgsql", "p-cpe:/a:novell:suse_linux:dovecot23-backend-sqlite", "p-cpe:/a:novell:suse_linux:dovecot23-devel", "p-cpe:/a:novell:suse_linux:dovecot23-fts", "p-cpe:/a:novell:suse_linux:dovecot23-fts-lucene", "p-cpe:/a:novell:suse_linux:dovecot23-fts-solr", "p-cpe:/a:novell:suse_linux:dovecot23-fts-squat", "cpe:/o:novell:suse_linux:15"], "id": "SUSE_SU-2021-2122-1.NASL", "href": "https://www.tenable.com/plugins/nessus/151090", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were extracted from\n# SUSE update advisory SUSE-SU-2021:2122-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(151090);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/07/13\");\n\n script_cve_id(\"CVE-2021-29157\", \"CVE-2021-33515\");\n script_xref(name:\"SuSE\", value:\"SUSE-SU-2021:2122-1\");\n\n script_name(english:\"SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2122-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the SUSE-SU-2021:2122-1 advisory.\n\n - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick\n OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs\n during use of local JWT validation with the posix fs driver. (CVE-2021-29157)\n\n - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive\n information can be redirected to an attacker-controlled address. (CVE-2021-33515)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187418\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1187419\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-29157\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-33515\");\n # https://lists.suse.com/pipermail/sle-security-updates/2021-June/009068.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e16773ca\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-33515\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2021-29157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/06/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/06/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/06/28\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-pgsql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-backend-sqlite\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-lucene\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-solr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:dovecot23-fts-squat\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item(\"Host/SuSE/release\");\nif (isnull(os_release) || os_release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nvar os_ver = pregmatch(pattern: \"^(SLE(S|D)(?:_SAP)?\\d+)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES15|SLES_SAP15)$\", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLES15 / SLES_SAP15', 'SUSE (' + os_ver + ')');\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE (' + os_ver + ')', cpu);\n\nvar service_pack = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(service_pack)) service_pack = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(0)$\", string:service_pack))) audit(AUDIT_OS_NOT, \"SLES15 SP0\", os_ver + \" SP\" + service_pack);\nif (os_ver == \"SLES_SAP15\" && (! preg(pattern:\"^(0)$\", string:service_pack))) audit(AUDIT_OS_NOT, \"SLES_SAP15 SP0\", os_ver + \" SP\" + service_pack);\n\nvar pkgs = [\n {'reference':'dovecot23-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-backend-mysql-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-backend-pgsql-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-backend-sqlite-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-devel-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-fts-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-fts-lucene-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-fts-solr-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-fts-squat-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},\n {'reference':'dovecot23-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-mysql-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-mysql-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-mysql-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-mysql-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-pgsql-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-pgsql-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-pgsql-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-pgsql-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-sqlite-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-sqlite-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-sqlite-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-backend-sqlite-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-devel-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-devel-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-devel-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-devel-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-lucene-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-lucene-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-lucene-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-lucene-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-solr-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-solr-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-solr-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-solr-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-squat-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-squat-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-squat-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-fts-squat-2.3.11.3-4.35.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},\n {'reference':'dovecot23-2.3.11.3-4.35.1', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']},\n {'reference':'dovecot23-backend-mysql-2.3.11.3-4.35.1', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']},\n {'reference':'dovecot23-backend-pgsql-2.3.11.3-4.35.1', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']},\n {'reference':'dovecot23-backend-sqlite-2.3.11.3-4.35.1', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']},\n {'reference':'dovecot23-devel-2.3.11.3-4.35.1', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']},\n {'reference':'dovecot23-fts-2.3.11.3-4.35.1', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']},\n {'reference':'dovecot23-fts-lucene-2.3.11.3-4.35.1', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']},\n {'reference':'dovecot23-fts-solr-2.3.11.3-4.35.1', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']},\n {'reference':'dovecot23-fts-squat-2.3.11.3-4.35.1', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']}\n];\n\nvar ltss_caveat_required = FALSE;\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var exists_check = NULL;\n var rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && _release) {\n if (exists_check) {\n var check_flag = 0;\n foreach var check (exists_check) {\n if (!rpm_exists(release:_release, rpm:check)) continue;\n if ('ltss' >< tolower(check)) ltss_caveat_required = TRUE;\n check_flag++;\n }\n if (!check_flag) continue;\n }\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n var ltss_plugin_caveat = NULL;\n if(ltss_caveat_required) ltss_plugin_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in SUSE Enterprise Linux Server LTSS\\n' +\n 'repositories. Access to these package security updates require\\n' +\n 'a paid SUSE LTSS subscription.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + ltss_plugin_caveat\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dovecot23 / dovecot23-backend-mysql / dovecot23-backend-pgsql / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "gentoo": [{"lastseen": "2023-05-27T14:58:18", "description": "### Background\n\nDovecot is an open source IMAP and POP3 email server.\n\n### Description\n\nMultiple vulnerabilities have been discovered in Dovecot. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nPlease review the referenced CVE identifiers for details.\n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll Dovecot users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-mail/dovecot-2.3.14.1\"", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-07-18T00:00:00", "type": "gentoo", "title": "Dovecot: Multiple vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-29157", "CVE-2021-33515"], "modified": "2021-07-18T00:00:00", "id": "GLSA-202107-41", "href": "https://security.gentoo.org/glsa/202107-41", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "ubuntu": [{"lastseen": "2023-05-27T15:00:39", "description": "## Releases\n\n * Ubuntu 21.04 \n * Ubuntu 20.10 \n * Ubuntu 20.04 LTS\n\n## Packages\n\n * dovecot \\- IMAP and POP3 email server\n\nKirin discovered that Dovecot incorrectly escaped kid and azp fields in JWT \ntokens. A local attacker could possibly use this issue to validate tokens \nusing arbitrary keys. This issue only affected Ubuntu 20.10 and Ubuntu \n21.04. (CVE-2021-29157)\n\nFabian Ising and Damian Poddebniak discovered that Dovecot incorrectly \nhandled STARTTLS when using the SMTP submission service. A remote attacker \ncould possibly use this issue to inject plaintext commands before \nSTARTTLS negotiation. (CVE-2021-33515)\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-06-21T00:00:00", "type": "ubuntu", "title": "Dovecot vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-29157", "CVE-2021-33515"], "modified": "2021-06-21T00:00:00", "id": "USN-4993-1", "href": "https://ubuntu.com/security/notices/USN-4993-1", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "freebsd": [{"lastseen": "2023-05-27T14:56:04", "description": "\n\nDovecot team reports:\n\nCVE-2021-29157: Dovecot does not correctly escape kid and azp\n\t fields in JWT tokens.\n\t This may be used to supply attacker controlled keys to validate\n\t tokens in some configurations. This requires attacker\n\t to be able to write files to\n\t local disk.\n\n\nCVE-2021-33515: On-path attacker could inject plaintext commands\n\t before STARTTLS negotiation that would be executed after STARTTLS\n\t finished with the client. Only the SMTP submission service is\n\t affected.\n\n\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-03-22T00:00:00", "type": "freebsd", "title": "dovecot -- multiple vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-29157", "CVE-2021-33515"], "modified": "2021-03-22T00:00:00", "id": "D18F431D-D360-11EB-A32C-00A0989E4EC1", "href": "https://vuxml.freebsd.org/freebsd/d18f431d-d360-11eb-a32c-00a0989e4ec1.html", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "archlinux": [{"lastseen": "2023-05-27T16:21:14", "description": "Arch Linux Security Advisory ASA-202106-56\n==========================================\n\nSeverity: High\nDate : 2021-06-22\nCVE-ID : CVE-2021-29157 CVE-2021-33515\nPackage : dovecot\nType : information disclosure\nRemote : Yes\nLink : https://security.archlinux.org/AVG-2087\n\nSummary\n=======\n\nThe package dovecot before version 2.3.15-1 is vulnerable to\ninformation disclosure.\n\nResolution\n==========\n\nUpgrade to 2.3.15-1.\n\n# pacman -Syu \"dovecot>=2.3.15-1\"\n\nThe problems have been fixed upstream in version 2.3.15.\n\nWorkaround\n==========\n\nCVE-2021-29157 can be mitigated by disabling local JWT validation in\noauth2, or using a different dict driver than fs:posix. No known\nworkaround exists for CVE-2021-33515.\n\nDescription\n===========\n\n- CVE-2021-29157 (information disclosure)\n\nA security issue has been found in Dovecot before version 2.3.14.1. The\nkid and azp fields in JWT tokens are not correctly escaped. This may be\nused to supply attacker controlled keys to validate tokens in some\nconfigurations. The attack requires an attacker to be able to write\nfiles to the local disk. As a result, a local attacker can login as any\nuser and access their emails.\n\n- CVE-2021-33515 (information disclosure)\n\nA security issue has been found in Dovecot before version 2.3.14.1. An\non-path attacker could inject plaintext commands before the STARTTLS\nnegotiation that would be executed after STARTTLS finished with the\nclient. Only the SMTP submission service is affected. As a result, an\nattacker can potentially steal user credentials and emails. The\nattacker needs to have sending permissions on the submission server (a\nvalid username and password).\n\nImpact\n======\n\nA remote authenticated attacker or a local attacker with write access\nto the disk could disclose user credentials and emails.\n\nReferences\n==========\n\nhttps://dovecot.org/pipermail/dovecot-news/2021-June/000461.html\nhttps://github.com/dovecot/core/commit/7f06f6274437ea97142df1f64f322b3ced44d0b3\nhttps://github.com/dovecot/core/commit/7a77e070ddb6a67fe7a40118ba3e3f9b6062a7d1\nhttps://github.com/dovecot/core/commit/bae4e44596d6548322665d242b055f44fe1dc58d\nhttps://dovecot.org/pipermail/dovecot-news/2021-June/000462.html\nhttps://github.com/dovecot/core/commit/65bd1a27a361545c9ccf405b955c72a9c4d29b38\nhttps://security.archlinux.org/CVE-2021-29157\nhttps://security.archlinux.org/CVE-2021-33515", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-06-22T00:00:00", "type": "archlinux", "title": "[ASA-202106-56] dovecot: information disclosure", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-29157", "CVE-2021-33515"], "modified": "2021-06-22T00:00:00", "id": "ASA-202106-56", "href": "https://security.archlinux.org/ASA-202106-56", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "altlinux": [{"lastseen": "2023-03-31T19:17:25", "description": "2.3.16-alt1 built Aug. 19, 2021 Andrey Cherepanov in task #282506\n\nAug. 12, 2021 Andrey Cherepanov\n \n \n - Updated to 2.3.16 (fixes CVE-2021-33515, CVE-2021-29157, CVE-2021-33515, CVE-2021-29157).\n - Package watch file.\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-08-19T00:00:00", "type": "altlinux", "title": "Security fix for the ALT Linux 9 package dovecot version 2.3.16-alt1", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-29157", "CVE-2021-33515"], "modified": "2021-08-19T00:00:00", "id": "4B6531FB5455E9EC9B8C6A0747171C34", "href": "https://packages.altlinux.org/en/p9/srpms/dovecot/", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "fedora": [{"lastseen": "2023-06-06T15:26:45", "description": "Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are in their subpackages. ", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-07-05T01:33:52", "type": "fedora", "title": "[SECURITY] Fedora 34 Update: dovecot-2.3.15-1.fc34", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-28200", "CVE-2021-29157", "CVE-2021-33515"], "modified": "2021-07-05T01:33:52", "id": "FEDORA:B547030832D6", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2023-06-06T15:26:45", "description": "Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are in their subpackages. ", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-07-05T01:36:13", "type": "fedora", "title": "[SECURITY] Fedora 33 Update: dovecot-2.3.15-1.fc33", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-28200", "CVE-2021-29157", "CVE-2021-33515"], "modified": "2021-07-05T01:36:13", "id": "FEDORA:AD57D301DAC4", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "mageia": [{"lastseen": "2023-06-06T16:28:10", "description": "Updated dovecot packages fix security vulnerabilities: The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension (CVE-2020-28200). Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver (CVE-2021-29157). The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address (CVE-2021-33515). \n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-12-19T12:26:08", "type": "mageia", "title": "Updated dovecot packages fix security vulnerabilities\n", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-28200", "CVE-2021-29157", "CVE-2021-33515"], "modified": "2021-12-19T12:26:08", "id": "MGASA-2021-0557", "href": "https://advisories.mageia.org/MGASA-2021-0557.html", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}]}
CVE-2021-29157
