CVE-2021-29157
High
Description
Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Dovecot
PublishedJun 28, 2021
First seenJun 28, 2021
How to fix
Update
- dovecot dovecot2.3.14.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dovecot dovecot | 2.3.11 ≤ v < 2.3.14.1 | 2.3.14.1 |
| fedoraproject fedora | 33, 34 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.