An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20.
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 4 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-287.
Summary
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:* | 2.3 to before 2.4.0 | Vulnerable | The Dovecot Project |
| cpe:2.3:a:dovecot:dovecot:2.2:*:*:*:*:*:*:* | 2.2 | Vulnerable | The Dovecot Project |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:* Versions 2.3 to before 2.4.0 Vulnerable ·The Dovecot Project
- cpe:2.3:a:dovecot:dovecot:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·The Dovecot Project
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Remediation
Red Hat 2 advisories
- RHSA-2022:8208 Released 2022-11-15 · Red Hat rating Moderatedovecot security and enhancement update
- Red Hat CodeReady Linux Builder (v. 9) dovecot-1:2.3.16-7.el9, dovecot-devel-1:2.3.16-7.el9
- Red Hat Enterprise Linux AppStream (v. 9) dovecot-1:2.3.16-7.el9, dovecot-mysql-1:2.3.16-7.el9, dovecot-pgsql-1:2.3.16-7.el9 +1
- RHSA-2022:7623 Released 2022-11-08 · Red Hat rating Moderatedovecot security update
- Red Hat CodeReady Linux Builder (v. 8) dovecot-1:2.3.16-3.el8, dovecot-devel-1:2.3.16-3.el8
- Red Hat Enterprise Linux AppStream (v. 8) dovecot-1:2.3.16-3.el8, dovecot-mysql-1:2.3.16-3.el8, dovecot-pgsql-1:2.3.16-3.el8 +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2022:7623 |
| Red Hat CodeReady Linux Builder (v. 9) | Fixed | RHSA-2022:8208 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:7623 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:8208 |
Not affected: 1 product
- Red Hat Enterprise Linux 6
Timeline
- 2026-10-02 Threatist record created from CVE-2022-30550
- 2026-10-03 Alias added: GHSA-cch8-vp96-g53m
References
Sources
- CVE-2022-30550 · CVE Program
- CVE-2022-30550 · NVD
- FIRST EPSS
- GHSA-cch8-vp96-g53m · GitHub Advisory Database · CC BY 4.0
- CVE-2022-30550 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences