Most recent entries from all

ALSA-2022:1950 — Moderate: dovecot security update

Affected: AlmaLinux:8: dovecot, AlmaLinux:8: dovecot-devel, AlmaLinux:8: dovecot-mysql, AlmaLinux:8: dovecot-pgsql, AlmaLinux:8: dovecot-pigeonhole

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

The following packages have been upgraded to a later upstream version: dovecot (2.3.16). (BZ#1980014)

Security Fix(es):

* dovecot: plaintext commands injection (CVE-2021-33515)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2021-03236

EUVD-2026-28444

fkie_cve-2021-33515

The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.

GHSA-pwmq-cvcm-r5p2

The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.

gsd-2021-33515

msrc_CVE-2021-33515 — The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information ca…

msrc_CVE-2021-33515

OESA-2021-1270 — dovecot security update

Affected: openEuler:20.03-LTS-SP1: dovecot

Dovecot is an IMAP server for Linux/UNIX-like systemsa wrapper package that will just handle common things for all versioned dovecot packages. Security Fix(es): The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension.(CVE-2020-28200) The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.(CVE-2021-33515)

openSUSE-SU-2021:0920-1 — Security update for dovecot23

Security update for dovecot23

SUSE-SU-2021:2122-1 — Security update for dovecot23

Security update for dovecot23

UBUNTU-CVE-2021-33515

Affected: Ubuntu:20.04:LTS: dovecot

The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.

WID-SEC-W-2022-1536 — Dovecot: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Dovecot ausnutzen, um einen Denial of Service Angriff durchzuführen, Benutzerrechte erlangen oder Informationen offenzulegen.