dovecot: CVE-2022-30550

Debian Bug report logs - #1016351
dovecot: CVE-2022-30550

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: submit@bugs.debian.org

Subject: dovecot: CVE-2022-30550

Date: Fri, 29 Jul 2022 22:49:20 +0200

Source: dovecot
X-Debbugs-CC: team@security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerability was published for dovecot.

CVE-2022-30550[0]:
| An issue was discovered in the auth component in Dovecot 2.2 and 2.3
| before 2.3.20. When two passdb configuration entries exist with the
| same driver and args settings, incorrect username_filter and mechanism
| settings can be applied to passdb definitions. These incorrectly
| applied settings can lead to an unintended security configuration and
| can permit privilege escalation in certain configurations. The
| documentation does not advise against the use of passdb definitions
| that have the same driver and args settings. One such configuration
| would be where an administrator wishes to use the same PAM
| configuration or passwd file for both normal and master users but use
| the username_filter setting to restrict which of the users is able to
| be a master user.

https://www.openwall.com/lists/oss-security/2022/07/06/9
https://github.com/dovecot/core/commit/7bad6a24160e34bce8f10e73dbbf9e5fbbcd1904
https://github.com/dovecot/core/commit/a1022072e2ce36f853873d910287f466165b184b

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-30550
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30550

Please adjust the affected versions in the BTS as needed.

Message #10 received at 1016351@bugs.debian.org (full text, mbox, reply):

From: Noah Meyerhans <frodo@morgul.net>

To: Moritz Mühlenhoff <jmm@inutil.org>, 1016351@bugs.debian.org

Subject: Re: Bug#1016351: dovecot: CVE-2022-30550

Date: Fri, 29 Jul 2022 14:52:32 -0700

[Message part 1 (text/plain, inline)]

Control: tags -1 + pending

The fix targeting sid is pending review on salsa.

My inclination is that this won't need a DSA and can wait for a bullseye point release, but I'm open to other opinions.

-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.

[Message part 2 (text/html, inline)]

Send a report that this bug log contains spam.