CVE-2021-33515 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4.8 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 90%

Affected Products (NVD)

Vendor	Product	Version
dovecot	dovecot	𝑥 < 2.3.14.1
debian	debian_linux	10.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

dovecot

bookworm	1:2.3.19.1+dfsg1-2.1+deb12u1 fixed
bookworm (security)	1:2.3.19.1+dfsg1-2.1+deb12u1 fixed
bullseye	1:2.3.13+dfsg1-2+deb11u1 fixed
bullseye (security)	1:2.3.13+dfsg1-2+deb11u2 fixed
sid	1:2.3.21.1+dfsg1-1 fixed
stretch	not-affected
trixie	1:2.3.21.1+dfsg1-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

dovecot

bionic	not-affected
focal	Fixed 1:2.3.7.2-1ubuntu3.4 released
groovy	Fixed 1:2.3.11.3+dfsg1-2ubuntu0.2 released
hirsute	Fixed 1:2.3.13+dfsg1-1ubuntu1.1 released
impish	Fixed 2.3.13+dfsg1-1ubuntu2 released
jammy	Fixed 2.3.13+dfsg1-1ubuntu2 released
trusty	not-affected
xenial	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

dovecot23

suse enterprise sap 15 SP2	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP4	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP5	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP6	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP7	2.3.11.3-55.1 fixed
suse enterprise server 15	2.3.11.3-4.35.1 fixed
suse enterprise server 15 SP1	2.3.11.3-24.1 fixed
suse enterprise server 15 SP2	2.3.11.3-55.1 fixed
suse enterprise server 15 SP3	2.3.11.3-55.1 fixed
suse enterprise server 15 SP4	2.3.11.3-55.1 fixed
suse enterprise server 15 SP5	2.3.11.3-55.1 fixed
suse enterprise server 15 SP6	2.3.11.3-55.1 fixed
suse enterprise server 15 SP7	2.3.11.3-55.1 fixed

dovecot23-backend-mysql

suse enterprise sap 15 SP2	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP4	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP5	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP6	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP7	2.3.11.3-55.1 fixed
suse enterprise server 15	2.3.11.3-4.35.1 fixed
suse enterprise server 15 SP1	2.3.11.3-24.1 fixed
suse enterprise server 15 SP2	2.3.11.3-55.1 fixed
suse enterprise server 15 SP3	2.3.11.3-55.1 fixed
suse enterprise server 15 SP4	2.3.11.3-55.1 fixed
suse enterprise server 15 SP5	2.3.11.3-55.1 fixed
suse enterprise server 15 SP6	2.3.11.3-55.1 fixed
suse enterprise server 15 SP7	2.3.11.3-55.1 fixed

dovecot23-backend-pgsql

suse enterprise sap 15 SP2	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP4	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP5	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP6	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP7	2.3.11.3-55.1 fixed
suse enterprise server 15	2.3.11.3-4.35.1 fixed
suse enterprise server 15 SP1	2.3.11.3-24.1 fixed
suse enterprise server 15 SP2	2.3.11.3-55.1 fixed
suse enterprise server 15 SP3	2.3.11.3-55.1 fixed
suse enterprise server 15 SP4	2.3.11.3-55.1 fixed
suse enterprise server 15 SP5	2.3.11.3-55.1 fixed
suse enterprise server 15 SP6	2.3.11.3-55.1 fixed
suse enterprise server 15 SP7	2.3.11.3-55.1 fixed

dovecot23-backend-sqlite

suse enterprise sap 15 SP2	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP4	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP5	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP6	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP7	2.3.11.3-55.1 fixed
suse enterprise server 15	2.3.11.3-4.35.1 fixed
suse enterprise server 15 SP1	2.3.11.3-24.1 fixed
suse enterprise server 15 SP2	2.3.11.3-55.1 fixed
suse enterprise server 15 SP3	2.3.11.3-55.1 fixed
suse enterprise server 15 SP4	2.3.11.3-55.1 fixed
suse enterprise server 15 SP5	2.3.11.3-55.1 fixed
suse enterprise server 15 SP6	2.3.11.3-55.1 fixed
suse enterprise server 15 SP7	2.3.11.3-55.1 fixed

dovecot23-devel

suse enterprise sap 15 SP2	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP4	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP5	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP6	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP7	2.3.11.3-55.1 fixed
suse enterprise server 15	2.3.11.3-4.35.1 fixed
suse enterprise server 15 SP1	2.3.11.3-24.1 fixed
suse enterprise server 15 SP2	2.3.11.3-55.1 fixed
suse enterprise server 15 SP3	2.3.11.3-55.1 fixed
suse enterprise server 15 SP4	2.3.11.3-55.1 fixed
suse enterprise server 15 SP5	2.3.11.3-55.1 fixed
suse enterprise server 15 SP6	2.3.11.3-55.1 fixed
suse enterprise server 15 SP7	2.3.11.3-55.1 fixed

dovecot23-fts

suse enterprise sap 15 SP2	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP4	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP5	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP6	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP7	2.3.11.3-55.1 fixed
suse enterprise server 15	2.3.11.3-4.35.1 fixed
suse enterprise server 15 SP1	2.3.11.3-24.1 fixed
suse enterprise server 15 SP2	2.3.11.3-55.1 fixed
suse enterprise server 15 SP3	2.3.11.3-55.1 fixed
suse enterprise server 15 SP4	2.3.11.3-55.1 fixed
suse enterprise server 15 SP5	2.3.11.3-55.1 fixed
suse enterprise server 15 SP6	2.3.11.3-55.1 fixed
suse enterprise server 15 SP7	2.3.11.3-55.1 fixed

dovecot23-fts-lucene

suse enterprise sap 15 SP2	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP4	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP5	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP6	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP7	2.3.11.3-55.1 fixed
suse enterprise server 15	2.3.11.3-4.35.1 fixed
suse enterprise server 15 SP1	2.3.11.3-24.1 fixed
suse enterprise server 15 SP2	2.3.11.3-55.1 fixed
suse enterprise server 15 SP3	2.3.11.3-55.1 fixed
suse enterprise server 15 SP4	2.3.11.3-55.1 fixed
suse enterprise server 15 SP5	2.3.11.3-55.1 fixed
suse enterprise server 15 SP6	2.3.11.3-55.1 fixed
suse enterprise server 15 SP7	2.3.11.3-55.1 fixed

dovecot23-fts-solr

suse enterprise sap 15 SP2	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP4	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP5	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP6	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP7	2.3.11.3-55.1 fixed
suse enterprise server 15	2.3.11.3-4.35.1 fixed
suse enterprise server 15 SP1	2.3.11.3-24.1 fixed
suse enterprise server 15 SP2	2.3.11.3-55.1 fixed
suse enterprise server 15 SP3	2.3.11.3-55.1 fixed
suse enterprise server 15 SP4	2.3.11.3-55.1 fixed
suse enterprise server 15 SP5	2.3.11.3-55.1 fixed
suse enterprise server 15 SP6	2.3.11.3-55.1 fixed
suse enterprise server 15 SP7	2.3.11.3-55.1 fixed

dovecot23-fts-squat

suse enterprise sap 15 SP2	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP3	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP4	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP5	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP6	2.3.11.3-55.1 fixed
suse enterprise sap 15 SP7	2.3.11.3-55.1 fixed
suse enterprise server 15	2.3.11.3-4.35.1 fixed
suse enterprise server 15 SP1	2.3.11.3-24.1 fixed
suse enterprise server 15 SP2	2.3.11.3-55.1 fixed
suse enterprise server 15 SP3	2.3.11.3-55.1 fixed
suse enterprise server 15 SP4	2.3.11.3-55.1 fixed
suse enterprise server 15 SP5	2.3.11.3-55.1 fixed
suse enterprise server 15 SP6	2.3.11.3-55.1 fixed
suse enterprise server 15 SP7	2.3.11.3-55.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

dovecot

RHEL 8

1:2.3.16-2.el8

fixed

dovecot-devel

RHEL 8

1:2.3.16-2.el8

fixed

dovecot-mysql

RHEL 8

1:2.3.16-2.el8

fixed

dovecot-pgsql

RHEL 8

1:2.3.16-2.el8

fixed

dovecot-pigeonhole

RHEL 8

1:2.3.16-2.el8

fixed

Common Weakness Enumeration

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References

https://dovecot.org/security

https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/

https://security.gentoo.org/glsa/202107-41

https://www.openwall.com/lists/oss-security/2021/06/28/2

https://dovecot.org/security

https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/

https://security.gentoo.org/glsa/202107-41

https://www.openwall.com/lists/oss-security/2021/06/28/2