CVE-2022-30550
Description
A vulnerability was found in the Dovecot IMAP Server. When two passdb configuration entries exist in the Dovecot configuration, which have the same driver and args settings, the incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrect settings can lead to an unintended security configuration and can permit privilege escalation with certain configurations involving a master user authentication. If the same passwd file or PAM is used for both normal and master users, an attacker could easily become a master user, potentially escalating privileges on the system.
Mitigation
Always authenticate master users from a different source than regular users, for example, use a separate passwd file. Alternatively, you can use global ACLs to ensure that only legitimate master users have privileged access.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | 8.8 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | High | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | High | High | N/A |
| Availability Impact | None | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
AC:H, because a successful attack depends on conditions beyond the attacker's control. The attack is only possible when two passdb configuration entries exist in the Dovecot configuration, which have the same driver and args settings, then incorrect username_filter and mechanism settings can be applied to passdb definitions. Thus putting AC:H.
A:N, because though the attacker can become a master user, it is only possible to read, modify data of other users, but he cannot interrupt the services of other users.
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
