CVE-2021-29157: Path Traversal
Dovecot before 2.3.15 allows ../ Path Traversal. An attacker with access to the local filesystem can trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location. This occurs during use of local JWT validation with the posix fs driver.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-29157?
CVE-2021-29157 is a vulnerability in Dovecot before 2.3.15 that allows for path traversal.
What is the severity of CVE-2021-29157?
CVE-2021-29157 has a severity rating of high, with a severity value of 5.5.
How does CVE-2021-29157 affect Dovecot?
CVE-2021-29157 affects Dovecot versions up to 2.3.14.1, allowing for path traversal and potential misuse of OAuth2 authentication.
Is there a fix available for CVE-2021-29157?
Yes, the fix for CVE-2021-29157 is included in Dovecot version 2.3.15.
Where can I find more information about CVE-2021-29157?
You can find more information about CVE-2021-29157 at the following references: [https://dovecot.org/security](https://dovecot.org/security), [https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/), [https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/)