[<prev] [next>] [day] [month] [year] [list]
Message-ID: <DB28AB9A-808E-4D20-8401-58863BBDEFDB@camelia.dev>
Date: Wed, 29 Oct 2025 08:49:48 +0000
From: Camelia Lavender <cam@...elia.dev>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-30189: Dovecot IMAP Server: Using auth caching
causes the first lookup to be cached for all lookups
-------- Original Message --------
From: Aki Tuomi via Dovecot-news <dovecot-news@...ecot.org>
Sent: October 29, 2025 8:22:46 AM UTC
To: "dovecot@...ecot.org" <dovecot@...ecot.org>, "dovecot-news@...ecot.org" <dovecot-news@...ecot.org>
Subject: [Dovecot-news] CVE-2025-30189 notification
Affected product: Dovecot IMAP Server
Internal reference: DOV-7830
Vulnerability type: CWE-1250 (Improper Preservation of Consistency Between Independent Representations of Shared State)
Vulnerable version: 2.4.0, 2.4.1
Vulnerable component: auth
Report confidence: Confirmed
Solution status: Fixed in 2.4.2
Researcher credits: Erik <erik@...adlux.com>
Vendor notification: 2025-07-25
CVE reference: CVE-2025-30189
CVSS: 7.4 (CVSS3.1:AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Vulnerability Details:
Using auth caching with oauth2 passdb, passwd passdb or userdb, or passwd userdb, causes the first lookup to be cached for all the lookups. This is because the cache key is "%u" which no longer actually expands to same as "%{user}".
Workaround:
Disabling auth cache will prevent the issue.
Fix
Install non-vulnerable version of Dovecot. Patch can be found at https://github.com/dovecot/core/compare/a70ce7d3e2f983979e971414c5892c4e30197231%5E...34caed79b76a7b82a2a9c94cf35371bec6c2b826.patch
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
