Bug 797349 (CVE-2021-29157, CVE-2021-33515) – <net-mail/dovecot-2.3.14.1: Multiple vulnerabilities (CVE-2021-{29157,33515})

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Sam James 2021-06-21 11:27:38 UTC]

* CVE-2021-29157

Description:
"Dovecot does not correctly escape kid and azp fields in
JWT tokens. This may be used to supply attacker controlled keys to
validate tokens, if attacker has local access."

* CVE-2021-33515

Description:
"On-path attacker could have injected plaintext commands before STARTTLS negotiation that would be executed after STARTTLS finished with the client."


----
Please bump to 2.3.14.1 and 2.3.15. Thanks!

[Comment 1 Larry the Git Cow 2021-06-21 13:40:29 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e240bf58ed54e64da0a1b7eae61a2b0d5ffd2c3c

commit e240bf58ed54e64da0a1b7eae61a2b0d5ffd2c3c
Author:     Eray Aslan <[e-mail]>
AuthorDate: 2021-06-21 13:40:10 +0000
Commit:     Eray Aslan <[e-mail]>
CommitDate: 2021-06-21 13:40:10 +0000

    net-mail/dovecot: security bump to 2.3.14.1
    
    Bug: https://bugs.gentoo.org/797349
    Package-Manager: Portage-3.0.20, Repoman-3.0.3
    Signed-off-by: Eray Aslan <[e-mail]>

 net-mail/dovecot/Manifest                |   1 +
 net-mail/dovecot/dovecot-2.3.14.1.ebuild | 293 +++++++++++++++++++++++++++++++
 2 files changed, 294 insertions(+)

[Comment 2 Sam James 2021-06-21 14:14:44 UTC]

Thanks eras!

[Comment 3 Sam James 2021-06-21 19:04:16 UTC]

x86 done

[Comment 4 Agostino Sarubbo 2021-06-22 06:47:25 UTC]

amd64 stable

[Comment 5 Agostino Sarubbo 2021-06-22 06:47:51 UTC]

ppc stable

[Comment 6 Agostino Sarubbo 2021-06-22 06:48:43 UTC]

ppc64 stable

[addCollapseLink(7, 1, 'Toggle comment display'); Comment 7 NATTkA bot 2021-06-22 20:56:20 UTC Comment hidden (obsolete)]

Unable to check for sanity:

> no match for package: net-mail/dovecot-2.3.14.1

[Comment 8 Sam James 2021-07-17 04:59:41 UTC]

arm done

all arches done

[Comment 9 John Helmert III 2021-07-17 05:09:40 UTC]

Please cleanup, thanks!

[Comment 10 Larry the Git Cow 2021-07-17 13:01:14 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c7831824c64115adf396d7383272a078d7273633

commit c7831824c64115adf396d7383272a078d7273633
Author:     Eray Aslan <[e-mail]>
AuthorDate: 2021-07-17 13:00:54 +0000
Commit:     Eray Aslan <[e-mail]>
CommitDate: 2021-07-17 13:00:54 +0000

    net-mail/dovecot: cleanup
    
    Bug: https://bugs.gentoo.org/797349
    Package-Manager: Portage-3.0.20, Repoman-3.0.3
    Signed-off-by: Eray Aslan <[e-mail]>

 net-mail/dovecot/Manifest                          |   3 -
 net-mail/dovecot/dovecot-2.3.13-r101.ebuild        | 295 ---------------------
 net-mail/dovecot/dovecot-2.3.14-r1.ebuild          | 294 --------------------
 .../files/dovecot-2.3.13-32-bit-tests-1.patch      |  52 ----
 .../files/dovecot-2.3.13-32-bit-tests-2.patch      |  27 --
 .../dovecot/files/dovecot-unwind-generic.patch     |  15 --
 6 files changed, 686 deletions(-)

[Comment 11 John Helmert III 2021-07-17 16:37:05 UTC]

GLSA request filed.

[Comment 12 GLSAMaker/CVETool Bot 2021-07-18 03:47:57 UTC]

This issue was resolved and addressed in
 GLSA 202107-41 at https://security.gentoo.org/glsa/202107-41
by GLSA coordinator John Helmert III (ajak).