Vulnerability CVE-2021-29157: Information

Description

Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.

Severity: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2021-29157
Published: June 28, 2021
Modified: Nov. 7, 2023
Error type identifier: CWE-22

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
dovecotsisyphus2.3.16-alt12.3.21-alt3ALT-PU-2021-2500-1282488Fixed
dovecotp102.3.16-alt12.3.21-alt2ALT-PU-2021-2537-1282504Fixed
dovecotp92.3.16-alt12.3.16-alt1ALT-PU-2021-2579-1282506Fixed
dovecotc10f12.3.16-alt12.3.19.1-alt2ALT-PU-2021-2537-1282504Fixed
dovecotc9f22.3.16-alt12.3.19.1-alt2ALT-PU-2021-2548-1282505Fixed
dovecotp112.3.16-alt12.3.21-alt3ALT-PU-2021-2500-1282488Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://dovecot.org/security
  • Vendor Advisory
https://www.openwall.com/lists/oss-security/2021/06/28/1
  • Mailing List
  • Third Party Advisory
GLSA-202107-41
  • Third Party Advisory
FEDORA-2021-208340a217
    FEDORA-2021-891c1ab1ac

        1. Configuration 1

          cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*
          Start including
          2.3.11
          End excliding
          2.3.14.1

          Configuration 2

          cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
          cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
      VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
      Version: v24.5.3
      Back to top