CVE-2021-29157

HIGH

Dovecot < 2.3.15 - Path Traversal via OAuth2 JWT Validation Key Path

Title source: llm

Description

Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.

References (5)

Core 5

Core References

Vendor Advisory x_refsource_misc

https://dovecot.org/security

Mailing List, Third Party Advisory x_refsource_confirm

https://www.openwall.com/lists/oss-security/2021/06/28/1

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/202107-41

Scores

CVSS v3 7.5

EPSS 0.0047

EPSS Percentile 37.2%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Details

CWE

CWE-22

Status published

Products (3)

dovecot/dovecot 2.3.11 - 2.3.14.1

fedoraproject/fedora 33

fedoraproject/fedora 34

Published Jun 28, 2021

Tracked Since Feb 18, 2026