Published: 28/06/2021 Updated: 07/11/2023

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 4.8 | Impact Score: 2.5 | Exploitability Score: 2.2

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N

The submission service in Dovecot prior to 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.

Vulnerable Product	Search on Vulmon	Subscribe to Product
dovecot dovecot
fedoraproject fedora 33
fedoraproject fedora 34
debian debian linux 10.0

Synopsis Moderate: dovecot security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for dovecot is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a se ...

Debian Bug report logs - #990566 dovecot: CVE-2021-33515 CVE-2021-29157 CVE-2020-28200 Package: src:dovecot; Maintainer for src:dovecot is Dovecot Maintainers <dovecot@packagesdebianorg>; Reported by: Moritz Mühlenhoff <jmm@inutilorg> Date: Fri, 2 Jul 2021 08:45:02 UTC Severity: grave Tags: security, upstream F ...

A security issue has been found in Dovecot before version 23141 An on-path attacker could inject plaintext commands before the STARTTLS negotiation that would be executed after STARTTLS finished with the client Only the SMTP submission service is affected As a result, an attacker can potentially steal user credentials and mails The attacker ...

oss-sec mailing list archives   By Date By Thread </form>    CVE-2021-33515: Dovecot SMTP Submission service STARTTLS injection   Fro ...

CWE-77 https://dovecot.org/security https://www.openwall.com/lists/oss-security/2021/06/28/2 https://security.gentoo.org/glsa/202107-41 https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/https://access.redhat.com/errata/RHSA-2022:1950 https://nvd.nist.gov https://security.archlinux.org/CVE-2021-33515

CVE-2021-33515

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect