Security update for dovecot23 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:0920-1 Final 1 1 2021-06-25T06:16:04Z current 2021-06-25T06:16:04Z 2021-06-25T06:16:04Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for dovecot23 This update for dovecot23 fixes the following issues: - CVE-2021-29157: Local attacker can login as any user and access their emails (bsc#1187418) - CVE-2021-33515: Attacker can potentially steal user credentials and mails (bsc#1187419) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-920 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VRGETVIUWL6C53ONKOWQB6XMHGC4U2YM/ E-Mail link for openSUSE-SU-2021:0920-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1187418 SUSE Bug 1187418 https://bugzilla.suse.com/1187419 SUSE Bug 1187419 https://www.suse.com/security/cve/CVE-2021-29157/ SUSE CVE CVE-2021-29157 page https://www.suse.com/security/cve/CVE-2021-33515/ SUSE CVE CVE-2021-33515 page openSUSE Leap 15.2 dovecot23-2.3.11.3-lp152.2.9.1 dovecot23-backend-mysql-2.3.11.3-lp152.2.9.1 dovecot23-backend-pgsql-2.3.11.3-lp152.2.9.1 dovecot23-backend-sqlite-2.3.11.3-lp152.2.9.1 dovecot23-devel-2.3.11.3-lp152.2.9.1 dovecot23-fts-2.3.11.3-lp152.2.9.1 dovecot23-fts-lucene-2.3.11.3-lp152.2.9.1 dovecot23-fts-solr-2.3.11.3-lp152.2.9.1 dovecot23-fts-squat-2.3.11.3-lp152.2.9.1 dovecot23-2.3.11.3-lp152.2.9.1 as a component of openSUSE Leap 15.2 dovecot23-backend-mysql-2.3.11.3-lp152.2.9.1 as a component of openSUSE Leap 15.2 dovecot23-backend-pgsql-2.3.11.3-lp152.2.9.1 as a component of openSUSE Leap 15.2 dovecot23-backend-sqlite-2.3.11.3-lp152.2.9.1 as a component of openSUSE Leap 15.2 dovecot23-devel-2.3.11.3-lp152.2.9.1 as a component of openSUSE Leap 15.2 dovecot23-fts-2.3.11.3-lp152.2.9.1 as a component of openSUSE Leap 15.2 dovecot23-fts-lucene-2.3.11.3-lp152.2.9.1 as a component of openSUSE Leap 15.2 dovecot23-fts-solr-2.3.11.3-lp152.2.9.1 as a component of openSUSE Leap 15.2 dovecot23-fts-squat-2.3.11.3-lp152.2.9.1 as a component of openSUSE Leap 15.2 Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver. CVE-2021-29157 openSUSE Leap 15.2:dovecot23-2.3.11.3-lp152.2.9.1 openSUSE Leap 15.2:dovecot23-backend-mysql-2.3.11.3-lp152.2.9.1 openSUSE Leap 15.2:dovecot23-backend-pgsql-2.3.11.3-lp152.2.9.1 openSUSE Leap 15.2:dovecot23-backend-sqlite-2.3.11.3-lp152.2.9.1 openSUSE Leap 15.2:dovecot23-devel-2.3.11.3-lp152.2.9.1 openSUSE Leap 15.2:dovecot23-fts-2.3.11.3-lp152.2.9.1 openSUSE Leap 15.2:dovecot23-fts-lucene-2.3.11.3-lp152.2.9.1 openSUSE Leap 15.2:dovecot23-fts-solr-2.3.11.3-lp152.2.9.1 openSUSE Leap 15.2:dovecot23-fts-squat-2.3.11.3-lp152.2.9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VRGETVIUWL6C53ONKOWQB6XMHGC4U2YM/ https://www.suse.com/security/cve/CVE-2021-29157.html CVE-2021-29157 https://bugzilla.suse.com/1187418 SUSE Bug 1187418 The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address. CVE-2021-33515 openSUSE Leap 15.2:dovecot23-2.3.11.3-lp152.2.9.1 openSUSE Leap 15.2:dovecot23-backend-mysql-2.3.11.3-lp152.2.9.1 openSUSE Leap 15.2:dovecot23-backend-pgsql-2.3.11.3-lp152.2.9.1 openSUSE Leap 15.2:dovecot23-backend-sqlite-2.3.11.3-lp152.2.9.1 openSUSE Leap 15.2:dovecot23-devel-2.3.11.3-lp152.2.9.1 openSUSE Leap 15.2:dovecot23-fts-2.3.11.3-lp152.2.9.1 openSUSE Leap 15.2:dovecot23-fts-lucene-2.3.11.3-lp152.2.9.1 openSUSE Leap 15.2:dovecot23-fts-solr-2.3.11.3-lp152.2.9.1 openSUSE Leap 15.2:dovecot23-fts-squat-2.3.11.3-lp152.2.9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VRGETVIUWL6C53ONKOWQB6XMHGC4U2YM/ https://www.suse.com/security/cve/CVE-2021-33515.html CVE-2021-33515 https://bugzilla.suse.com/1187419 SUSE Bug 1187419