CVE-2021-29157
28.06.2021, 12:15
Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.
| Vendor | Product | Version |
|---|---|---|
| dovecot | dovecot | 2.3.11 ≤ 𝑥 < 2.3.14.1 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References