SB2022051155 - Red Hat Enterprise Linux 8 update for dovecot
Published: May 11, 2022
Security Bulletin ID
SB2022051155
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Code injection (CVE-ID: CVE-2021-33515)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists in the way STARTTLS command in processed by the SMTP server. the commands sent during the session before the STARTTLS command are queued and executed later, after the STARTTLS finished with the client. As a result, a remote attacker can perform a MitM attack and gain access to victim's emails.
Remediation
Install update from vendor's website.