CVE-2021-33515

 

Published at: - 28-06-2021 03:15

Last modified: - 28-09-2022 10:02

Total changes: - 7

Description

The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

 

Verification logic

 

Reference

• https://dovecot.org/security
• https://www.openwall.com/lists/oss-security/2021/06/28/2
• FEDORA-2021-891c1ab1ac-Mailing List, Third Party Advisory
• FEDORA-2021-208340a217-Mailing List, Third Party Advisory
• GLSA-202107-41-Third Party Advisory
• [debian-lts-announce] 20220927 [SECURITY] [DLA 3122-1] dovecot security update-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2021-33515

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures