Date: Mon, 28 Jun 2021 09:59:59 +0300 (EEST) From: Aki Tuomi <aki.tuomi@...n-xchange.com> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: CVE-2021-33515: Dovecot SMTP Submission service STARTTLS injection. Open-Xchange Security Advisory 2021-06-28 Affected product: Dovecot IMAP Server Vendor: OX Software GmbH Internal reference: DOP-2421 Vulnerability type: Cryptographic Issues (CWE-310) Vulnerable version: 2.3 Vulnerable component: submission Report confidence: Confirmed Solution status: Fixed in 2.3.x Researcher credits: Fabian Ising and Damian Poddebniak of Münster University of Applied Sciences. Vendor notification: 2021-05-21 CVE reference: CVE-2021-33515 CVSS: 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vulnerability Details: Dovecot's lib-smtp is vulnerable to STARTTLS command injection. If more commands are pipelined as plaintext after STARTTLS, those commands are run inside the TLS session. Risk: A MiTM attacker can inject preamble commands to be executed prior to user's commands, these can be used to redirect the actual mail and other user commands to attacker controlled address. Proof of concept script exists. Solution: Upgrade to fixed version, or disable STARTTLS support.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.