Bug#1016351: dovecot: CVE-2022-30550

From	Moritz Mühlenhoff <jmm@inutil.org>
Newsgroups	linux.debian.bugs.rc
Subject	Bug#1016351: dovecot: CVE-2022-30550
Date	2022-07-29 23:00 +0200
Message-ID	<EOFfr-eGp9-3@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

Source: dovecot
X-Debbugs-CC: team@security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerability was published for dovecot.

CVE-2022-30550[0]:
| An issue was discovered in the auth component in Dovecot 2.2 and 2.3
| before 2.3.20. When two passdb configuration entries exist with the
| same driver and args settings, incorrect username_filter and mechanism
| settings can be applied to passdb definitions. These incorrectly
| applied settings can lead to an unintended security configuration and
| can permit privilege escalation in certain configurations. The
| documentation does not advise against the use of passdb definitions
| that have the same driver and args settings. One such configuration
| would be where an administrator wishes to use the same PAM
| configuration or passwd file for both normal and master users but use
| the username_filter setting to restrict which of the users is able to
| be a master user.

https://www.openwall.com/lists/oss-security/2022/07/06/9
https://github.com/dovecot/core/commit/7bad6a24160e34bce8f10e73dbbf9e5fbbcd1904
https://github.com/dovecot/core/commit/a1022072e2ce36f853873d910287f466165b184b

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-30550
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30550

Please adjust the affected versions in the BTS as needed.

Back to linux.debian.bugs.rc | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1016351: dovecot: CVE-2022-30550 Moritz Mühlenhoff <jmm@inutil.org> - 2022-07-29 23:00 +0200
  Processed: Re: Bug#1016351: dovecot: CVE-2022-30550 "Debian Bug Tracking System" <owner@bugs.debian.org> - 2022-07-30 00:30 +0200
  Bug#1016351: dovecot: CVE-2022-30550 Moritz Mühlenhoff <jmm@inutil.org> - 2022-07-30 20:20 +0200
  Bug#1016351: marked as done (dovecot: CVE-2022-30550) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2022-07-31 18:00 +0200
  Bug#1016351: marked as done (dovecot: CVE-2022-30550) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2022-08-14 18:00 +0200

csiph-web