Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.
References
Configurations
History
07 Nov 2023, 03:32
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Information
Published : 2021-06-28 12:15
Updated : 2024-02-28 18:28
NVD link : CVE-2021-29157
Mitre link : CVE-2021-29157
CVE.ORG link : CVE-2021-29157
JSON object : View
Products Affected
dovecot
- dovecot
fedoraproject
- fedora
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')