Vulnerability Name:

CVE-2022-30550 (CCN-230560)

Assigned:2022-07-06
Published:2022-07-06
Updated:2022-10-28
Summary:An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
6.8 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
5.9 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
6.8 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
5.9 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:6.6 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-287
CWE-284
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2022-30550

Source: MISC
Type: Vendor Advisory
https://dovecot.org/security

Source: XF
Type: UNKNOWN
dovecot-cve202230550-priv-esc(230560)

Source: CCN
Type: Dovecot GIT Repository
[PATCH 1/2] auth: Fix handling passdbs with identical driver/args but different mechanisms/username_filter

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20220927 [SECURITY] [DLA 3122-1] dovecot security update

Source: CCN
Type: oss-sec Mailing List, Wed, 6 Jul 2022 16:54:47 +0300 (EEST)
CVE-2022-30550: Privilege escalation possible in dovecot when similar master and non-master passdbs are used

Source: MISC
Type: Product
https://www.dovecot.org/download/

Source: CONFIRM
Type: Mailing List, Patch, Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/07/08/1

Vulnerable Configuration:Configuration 1:
  • cpe:/a:dovecot:dovecot:*:*:*:*:*:*:*:* (Version >= 2.3 and < 2.3.20)
  • OR cpe:/a:dovecot:dovecot:2.2:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/a:redhat:enterprise_linux:9:*:*:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/a:redhat:enterprise_linux:9::appstream:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/a:redhat:enterprise_linux:9::crb:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:dovecot:dovecot:2.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.redhat.rhsa:def:20228208
    P
    		RHSA-2022:8208: dovecot security and enhancement update (Moderate)
    2022-11-15
    oval:com.redhat.rhsa:def:20227623
    P
    		RHSA-2022:7623: dovecot security update (Moderate)
    2022-11-08
    oval:org.opensuse.security:def:127335
    P
    		Security update for dovecot22 (Important)
    2022-08-01
    oval:org.opensuse.security:def:125774
    P
    		Security update for dovecot22 (Important)
    2022-08-01
    oval:org.opensuse.security:def:5316
    P
    		Security update for dovecot22 (Important)
    2022-08-01
    oval:org.opensuse.security:def:126937
    P
    		Security update for dovecot22 (Important)
    2022-08-01
    oval:org.opensuse.security:def:6125
    P
    		Security update for dovecot22 (Important)
    2022-08-01
    oval:org.opensuse.security:def:119450
    P
    		Security update for dovecot23 (Important)
    2022-07-20
    oval:org.opensuse.security:def:3767
    P
    		Security update for dovecot23 (Important)
    2022-07-20
    oval:org.opensuse.security:def:118765
    P
    		Security update for dovecot23 (Important)
    2022-07-20
    oval:org.opensuse.security:def:119635
    P
    		Security update for dovecot23 (Important)
    2022-07-20
    oval:org.opensuse.security:def:95400
    P
    		Security update for dovecot23 (Important)
    2022-07-20
    oval:org.opensuse.security:def:586
    P
    		Security update for dovecot23 (Important)
    2022-07-20
    oval:org.opensuse.security:def:118955
    P
    		Security update for dovecot23 (Important)
    2022-07-20
    oval:org.opensuse.security:def:119260
    P
    		Security update for dovecot23 (Important)
    2022-07-20
    BACK
    dovecot dovecot *
    dovecot dovecot 2.2
    debian debian linux 10.0
    dovecot dovecot 2.2