The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3122 advisory.

  - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive     information can be redirected to an attacker-controlled address. (CVE-2021-33515)

  - An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb     configuration entries exist with the same driver and args settings, incorrect username_filter and     mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an     unintended security configuration and can permit privilege escalation in certain configurations. The     documentation does not advise against the use of passdb definitions that have the same driver and args     settings. One such configuration would be where an administrator wishes to use the same PAM configuration     or passwd file for both normal and master users but use the username_filter setting to restrict which of     the users is able to be a master user. (CVE-2022-30550)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:1950 advisory.

  - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive     information can be redirected to an attacker-controlled address. (CVE-2021-33515)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-1950 advisory.

    [1:2.3.16-2]
    - do not disable xz/lzma for now despite being deprecated

    [1:2.3.16-1]
    - dovecot updated to 2.3.16, pigeonhole to 0.5.16
    - fix CVE-2021-33515 plaintext commands injection (#1980014)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:1950 advisory.

  - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive     information can be redirected to an attacker-controlled address. (CVE-2021-33515)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1950 advisory.

    Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind.
    It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL     drivers and authentication plug-ins are provided as subpackages.

    The following packages have been upgraded to a later upstream version: dovecot (2.3.16). (BZ#1980014)

    Security Fix(es):

    * dovecot: plaintext commands injection (CVE-2021-33515)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2022:1950 advisory.

  - dovecot: plaintext commands injection (CVE-2021-33515)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202107-41 (Dovecot: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Dovecot. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

According to the versions of the dovecot packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive     information can be redirected to an attacker-controlled address. (CVE-2021-33515)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2123-1 advisory.

  - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick     OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs     during use of local JWT validation with the posix fs driver. (CVE-2021-29157)

  - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive     information can be redirected to an attacker-controlled address. (CVE-2021-33515)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2124-1 advisory.

  - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick     OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs     during use of local JWT validation with the posix fs driver. (CVE-2021-29157)

  - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive     information can be redirected to an attacker-controlled address. (CVE-2021-33515)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2123-1 advisory.

  - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick     OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs     during use of local JWT validation with the posix fs driver. (CVE-2021-29157)

  - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive     information can be redirected to an attacker-controlled address. (CVE-2021-33515)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2122-1 advisory.

  - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick     OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs     during use of local JWT validation with the posix fs driver. (CVE-2021-29157)

  - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive     information can be redirected to an attacker-controlled address. (CVE-2021-33515)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:0920-1 advisory.

  - Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick     OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs     during use of local JWT validation with the posix fs driver. (CVE-2021-29157)

  - The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive     information can be redirected to an attacker-controlled address. (CVE-2021-33515)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Dovecot team reports :

CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens in some configurations. This requires attacker to be able to write files to local disk.

CVE-2021-33515: On-path attacker could inject plaintext commands before STARTTLS negotiation that would be executed after STARTTLS finished with the client. Only the SMTP submission service is affected.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4993-1 advisory.

    Kirin discovered that Dovecot incorrectly escaped kid and azp fields in JWT tokens. A local attacker could     possibly use this issue to validate tokens using arbitrary keys. This issue only affected Ubuntu 20.10 and     Ubuntu 21.04. (CVE-2021-29157)

    Fabian Ising and Damian Poddebniak discovered that Dovecot incorrectly handled STARTTLS when using the     SMTP submission service. A remote attacker could possibly use this issue to inject plaintext commands     before STARTTLS negotiation. (CVE-2021-33515)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
196201	RHEL 6 : dovecot (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
165510	Debian DLA-3122-1 : dovecot - LTS security update	Nessus	Debian Local Security Checks	high
161333	Rocky Linux 8 : dovecot (RLSA-2022:1950)	Nessus	Rocky Linux Local Security Checks	medium
161315	Oracle Linux 8 : dovecot (ELSA-2022-1950)	Nessus	Oracle Linux Local Security Checks	medium
161092	AlmaLinux 8 : dovecot (ALSA-2022:1950)	Nessus	Alma Linux Local Security Checks	medium
161008	RHEL 8 : dovecot (RHSA-2022:1950)	Nessus	Red Hat Local Security Checks	medium
160961	CentOS 8 : dovecot (CESA-2022:1950)	Nessus	CentOS Local Security Checks	medium
157022	GLSA-202107-41 : Dovecot: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
153629	EulerOS 2.0 SP8 : dovecot (EulerOS-SA-2021-2459)	Nessus	Huawei Local Security Checks	medium
151697	openSUSE 15 Security Update : dovecot23 (openSUSE-SU-2021:2123-1)	Nessus	SuSE Local Security Checks	medium
151106	SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2124-1)	Nessus	SuSE Local Security Checks	medium
151094	SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2123-1)	Nessus	SuSE Local Security Checks	medium
151090	SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2021:2122-1)	Nessus	SuSE Local Security Checks	medium
151056	openSUSE 15 Security Update : dovecot23 (openSUSE-SU-2021:0920-1)	Nessus	SuSE Local Security Checks	medium
151003	FreeBSD : dovecot -- multiple vulnerabilities (d18f431d-d360-11eb-a32c-00a0989e4ec1)	Nessus	FreeBSD Local Security Checks	medium
150939	Ubuntu 20.04 LTS : Dovecot vulnerabilities (USN-4993-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2021-33515

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium