Test ID:	1.3.6.1.4.1.25623.1.0.117513
Category:	General
Title:	Dovecot 2.3.11 - 2.3.14 Path Traversal Vulnerability
Summary:	Dovecot is prone to a path traversal vulnerability.
Description:	Summary: Dovecot is prone to a path traversal vulnerability. Vulnerability Insight: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens in some configurations. This requires attacker to be able to write files to local disk. Vulnerability Impact: Local attacker can login as any user and access their emails. Affected Software/OS: Dovecot version 2.3.11 through 2.3.14. Solution: Update to version 2.3.14.1 or later. Workaround: Disable local JWT validation in oauth2, or use a different dict driver than fs:posix. CVSS Score: 2.1 CVSS Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-29157 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/ https://security.gentoo.org/glsa/202107-41 https://dovecot.org/security
Copyright	Copyright (C) 2021 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.