SUSE update for dovecot23
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 5 |
| CVE-ID | CVE-2020-12100 CVE-2020-24386 CVE-2020-28200 CVE-2021-29157 CVE-2021-33515 |
| CWE-ID | CWE-835 CWE-200 CWE-399 CWE-22 CWE-74 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
SUSE Manager Proxy Operating systems & Components / Operating system SUSE Manager Retail Branch Server Operating systems & Components / Operating system SUSE Manager Server Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Enterprise Storage Operating systems & Components / Operating system SUSE CaaS Platform Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system dovecot23-fts-squat-debuginfo Operating systems & Components / Operating system package or component dovecot23-fts-squat Operating systems & Components / Operating system package or component dovecot23-fts-solr-debuginfo Operating systems & Components / Operating system package or component dovecot23-fts-solr Operating systems & Components / Operating system package or component dovecot23-fts-lucene-debuginfo Operating systems & Components / Operating system package or component dovecot23-fts-lucene Operating systems & Components / Operating system package or component dovecot23-fts-debuginfo Operating systems & Components / Operating system package or component dovecot23-fts Operating systems & Components / Operating system package or component dovecot23-devel Operating systems & Components / Operating system package or component dovecot23-debugsource Operating systems & Components / Operating system package or component dovecot23-debuginfo Operating systems & Components / Operating system package or component dovecot23-backend-sqlite-debuginfo Operating systems & Components / Operating system package or component dovecot23-backend-sqlite Operating systems & Components / Operating system package or component dovecot23-backend-pgsql-debuginfo Operating systems & Components / Operating system package or component dovecot23-backend-pgsql Operating systems & Components / Operating system package or component dovecot23-backend-mysql-debuginfo Operating systems & Components / Operating system package or component dovecot23-backend-mysql Operating systems & Components / Operating system package or component dovecot23 Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
1) Infinite loop
EUVDB-ID: #VU45671
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2020-12100
CWE-ID:
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in submission, lmtp, and lda when processing e-mail message with deeply nested MIME parts. A remote attacker can send a specially crafted email to consume all available system resources and cause denial of service conditions.
MitigationUpdate the affected package dovecot23 to the latest version.
Vulnerable software versionsSUSE Manager Proxy: 4.0
SUSE Manager Retail Branch Server: 4.0
SUSE Manager Server: 4.0
SUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-LTSS - 15-SP1-ESPOS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS
dovecot23-fts-squat-debuginfo: before 2.3.15-27.3
dovecot23-fts-squat: before 2.3.15-27.3
dovecot23-fts-solr-debuginfo: before 2.3.15-27.3
dovecot23-fts-solr: before 2.3.15-27.3
dovecot23-fts-lucene-debuginfo: before 2.3.15-27.3
dovecot23-fts-lucene: before 2.3.15-27.3
dovecot23-fts-debuginfo: before 2.3.15-27.3
dovecot23-fts: before 2.3.15-27.3
dovecot23-devel: before 2.3.15-27.3
dovecot23-debugsource: before 2.3.15-27.3
dovecot23-debuginfo: before 2.3.15-27.3
dovecot23-backend-sqlite-debuginfo: before 2.3.15-27.3
dovecot23-backend-sqlite: before 2.3.15-27.3
dovecot23-backend-pgsql-debuginfo: before 2.3.15-27.3
dovecot23-backend-pgsql: before 2.3.15-27.3
dovecot23-backend-mysql-debuginfo: before 2.3.15-27.3
dovecot23-backend-mysql: before 2.3.15-27.3
dovecot23: before 2.3.15-27.3
CPE2.3- cpe:2.3:o:suse:suse_manager_proxy:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-ESPOS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:dovecot23-fts-squat-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-squat:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-solr-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-solr:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-lucene-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-lucene:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-sqlite:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-pgsql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-mysql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20212891-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Information disclosure
EUVDB-ID: #VU49237
Risk: Medium
CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2020-24386
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to an error, related to IMAP hibernation. A remote user can run a specially crafted command to discover system directory structure and access emails of other users.
Update the affected package dovecot23 to the latest version.
Vulnerable software versionsSUSE Manager Proxy: 4.0
SUSE Manager Retail Branch Server: 4.0
SUSE Manager Server: 4.0
SUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-LTSS - 15-SP1-ESPOS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS
dovecot23-fts-squat-debuginfo: before 2.3.15-27.3
dovecot23-fts-squat: before 2.3.15-27.3
dovecot23-fts-solr-debuginfo: before 2.3.15-27.3
dovecot23-fts-solr: before 2.3.15-27.3
dovecot23-fts-lucene-debuginfo: before 2.3.15-27.3
dovecot23-fts-lucene: before 2.3.15-27.3
dovecot23-fts-debuginfo: before 2.3.15-27.3
dovecot23-fts: before 2.3.15-27.3
dovecot23-devel: before 2.3.15-27.3
dovecot23-debugsource: before 2.3.15-27.3
dovecot23-debuginfo: before 2.3.15-27.3
dovecot23-backend-sqlite-debuginfo: before 2.3.15-27.3
dovecot23-backend-sqlite: before 2.3.15-27.3
dovecot23-backend-pgsql-debuginfo: before 2.3.15-27.3
dovecot23-backend-pgsql: before 2.3.15-27.3
dovecot23-backend-mysql-debuginfo: before 2.3.15-27.3
dovecot23-backend-mysql: before 2.3.15-27.3
dovecot23: before 2.3.15-27.3
CPE2.3- cpe:2.3:o:suse:suse_manager_proxy:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-ESPOS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:dovecot23-fts-squat-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-squat:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-solr-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-solr:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-lucene-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-lucene:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-sqlite:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-pgsql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-mysql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20212891-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Resource management error
EUVDB-ID: #VU54284
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2020-28200
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within regex sieve extension. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
MitigationUpdate the affected package dovecot23 to the latest version.
Vulnerable software versionsSUSE Manager Proxy: 4.0
SUSE Manager Retail Branch Server: 4.0
SUSE Manager Server: 4.0
SUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-LTSS - 15-SP1-ESPOS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS
dovecot23-fts-squat-debuginfo: before 2.3.15-27.3
dovecot23-fts-squat: before 2.3.15-27.3
dovecot23-fts-solr-debuginfo: before 2.3.15-27.3
dovecot23-fts-solr: before 2.3.15-27.3
dovecot23-fts-lucene-debuginfo: before 2.3.15-27.3
dovecot23-fts-lucene: before 2.3.15-27.3
dovecot23-fts-debuginfo: before 2.3.15-27.3
dovecot23-fts: before 2.3.15-27.3
dovecot23-devel: before 2.3.15-27.3
dovecot23-debugsource: before 2.3.15-27.3
dovecot23-debuginfo: before 2.3.15-27.3
dovecot23-backend-sqlite-debuginfo: before 2.3.15-27.3
dovecot23-backend-sqlite: before 2.3.15-27.3
dovecot23-backend-pgsql-debuginfo: before 2.3.15-27.3
dovecot23-backend-pgsql: before 2.3.15-27.3
dovecot23-backend-mysql-debuginfo: before 2.3.15-27.3
dovecot23-backend-mysql: before 2.3.15-27.3
dovecot23: before 2.3.15-27.3
CPE2.3- cpe:2.3:o:suse:suse_manager_proxy:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-ESPOS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:dovecot23-fts-squat-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-squat:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-solr-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-solr:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-lucene-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-lucene:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-sqlite:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-pgsql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-mysql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20212891-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Path traversal
EUVDB-ID: #VU54285
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-29157
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform directory traversal attacks.
The vulnerability exists due to validation of kid and azp fields in JWT tokens. A local user to ability to control a JWT token location can login as any MTA user and access their emails.
Update the affected package dovecot23 to the latest version.
Vulnerable software versionsSUSE Manager Proxy: 4.0
SUSE Manager Retail Branch Server: 4.0
SUSE Manager Server: 4.0
SUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-LTSS - 15-SP1-ESPOS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS
dovecot23-fts-squat-debuginfo: before 2.3.15-27.3
dovecot23-fts-squat: before 2.3.15-27.3
dovecot23-fts-solr-debuginfo: before 2.3.15-27.3
dovecot23-fts-solr: before 2.3.15-27.3
dovecot23-fts-lucene-debuginfo: before 2.3.15-27.3
dovecot23-fts-lucene: before 2.3.15-27.3
dovecot23-fts-debuginfo: before 2.3.15-27.3
dovecot23-fts: before 2.3.15-27.3
dovecot23-devel: before 2.3.15-27.3
dovecot23-debugsource: before 2.3.15-27.3
dovecot23-debuginfo: before 2.3.15-27.3
dovecot23-backend-sqlite-debuginfo: before 2.3.15-27.3
dovecot23-backend-sqlite: before 2.3.15-27.3
dovecot23-backend-pgsql-debuginfo: before 2.3.15-27.3
dovecot23-backend-pgsql: before 2.3.15-27.3
dovecot23-backend-mysql-debuginfo: before 2.3.15-27.3
dovecot23-backend-mysql: before 2.3.15-27.3
dovecot23: before 2.3.15-27.3
CPE2.3- cpe:2.3:o:suse:suse_manager_proxy:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-ESPOS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:dovecot23-fts-squat-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-squat:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-solr-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-solr:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-lucene-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-lucene:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-sqlite:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-pgsql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-mysql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20212891-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Code injection
EUVDB-ID: #VU54286
Risk: Medium
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-33515
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists in the way STARTTLS command in processed by the SMTP server. the commands sent during the session before the STARTTLS command are queued and executed later, after the STARTTLS finished with the client. As a result, a remote attacker can perform a MitM attack and gain access to victim's emails.
Update the affected package dovecot23 to the latest version.
Vulnerable software versionsSUSE Manager Proxy: 4.0
SUSE Manager Retail Branch Server: 4.0
SUSE Manager Server: 4.0
SUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-LTSS - 15-SP1-ESPOS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS
dovecot23-fts-squat-debuginfo: before 2.3.15-27.3
dovecot23-fts-squat: before 2.3.15-27.3
dovecot23-fts-solr-debuginfo: before 2.3.15-27.3
dovecot23-fts-solr: before 2.3.15-27.3
dovecot23-fts-lucene-debuginfo: before 2.3.15-27.3
dovecot23-fts-lucene: before 2.3.15-27.3
dovecot23-fts-debuginfo: before 2.3.15-27.3
dovecot23-fts: before 2.3.15-27.3
dovecot23-devel: before 2.3.15-27.3
dovecot23-debugsource: before 2.3.15-27.3
dovecot23-debuginfo: before 2.3.15-27.3
dovecot23-backend-sqlite-debuginfo: before 2.3.15-27.3
dovecot23-backend-sqlite: before 2.3.15-27.3
dovecot23-backend-pgsql-debuginfo: before 2.3.15-27.3
dovecot23-backend-pgsql: before 2.3.15-27.3
dovecot23-backend-mysql-debuginfo: before 2.3.15-27.3
dovecot23-backend-mysql: before 2.3.15-27.3
dovecot23: before 2.3.15-27.3
CPE2.3- cpe:2.3:o:suse:suse_manager_proxy:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-ESPOS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:dovecot23-fts-squat-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-squat:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-solr-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-solr:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-lucene-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-lucene:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-fts:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-sqlite-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-sqlite:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-pgsql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23-backend-mysql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dovecot23:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20212891-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
