Описание
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.
A flaw was found in Dovecot. Forwarded information from a host listed as a trusted proxy is not properly separated from Dovecot's internal authentication fields. This allows a malicious host configured as a trusted proxy to inject values as internal authentication fields, enabling it to authenticate as any user without knowing their password. This vulnerability leads to unauthorized access and affects deployments where the password database honors a field that permits passwordless authentication.
Меры по смягчению последствий
To mitigate this issue, ensure that the auth_proxy_trusted_networks configuration in Dovecot is strictly limited to only trusted hosts that are fully under administrative control. Review and restrict the auth_proxy_trusted_networks setting in your Dovecot configuration (e.g., /etc/dovecot/conf.d/10-auth.conf or similar) to prevent unauthorized hosts from acting as trusted proxies. If trusted proxies are not required, remove this configuration entirely. A restart of the Dovecot service may be required for changes to take effect.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | dovecot | Fix deferred | ||
| Red Hat Enterprise Linux 6 | dovecot | Out of support scope | ||
| Red Hat Enterprise Linux 7 | dovecot | Fix deferred | ||
| Red Hat Enterprise Linux 8 | dovecot | Fix deferred | ||
| Red Hat Enterprise Linux 9 | dovecot | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS3
Связанные уязвимости
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.
Forwarding information received from a host listed as a trusted proxy ...
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.
EPSS
4.3 Medium
CVSS3