CVE-2021-33515 Command injection in n/a
Attackers can inject commands via STARTTLS in Dovecot's submission service to redirect sensitive information to attacker-controlled addresses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-33515?
CVE-2021-33515 is a medium-severity command injection vulnerability in Debian Debian Linux, published on 28 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
Weakness: CWE-77
Which versions are affected by CVE-2021-33515?
It affects 3 products.
Linux distribution packages (22)
dovecot AlmaLinux:8 | All versions | 1:2.3.16-2.el8 |
dovecot-devel AlmaLinux:8 | All versions | 1:2.3.16-2.el8 |
dovecot-mysql AlmaLinux:8 | All versions | 1:2.3.16-2.el8 |
dovecot-pgsql AlmaLinux:8 | All versions | 1:2.3.16-2.el8 |
dovecot-pigeonhole AlmaLinux:8 | All versions | 1:2.3.16-2.el8 |
dovecot Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-2.el8 |
dovecot-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-2.el8 |
dovecot-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-2.el8 |
dovecot-mysql Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-2.el8 |
dovecot-mysql-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-2.el8 |
dovecot-pgsql Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-2.el8 |
dovecot-pgsql-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-2.el8 |
dovecot-pigeonhole Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-2.el8 |
dovecot-pigeonhole-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.3.16-2.el8 |
dovecot Red Hat:enterprise_linux:8::crb | All versions | 1:2.3.16-2.el8 |
dovecot-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 1:2.3.16-2.el8 |
dovecot-debugsource Red Hat:enterprise_linux:8::crb | All versions | 1:2.3.16-2.el8 |
dovecot-devel Red Hat:enterprise_linux:8::crb | All versions | 1:2.3.16-2.el8 |
dovecot-mysql-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 1:2.3.16-2.el8 |
dovecot-pgsql-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 1:2.3.16-2.el8 |
dovecot-pigeonhole-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 1:2.3.16-2.el8 |
dovecot Rocky Linux:8 | All versions | 1:2.3.16-2.el8 |
Products include Debian Debian Linux, Dovecot Dovecot, Fedoraproject Fedora.
How do I fix CVE-2021-33515?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-33515 being exploited?
There is no known exploitation of CVE-2021-33515 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-33515, ALSA-2022:1950, AZL-7196, CLSA-2022-1653506138, CLSA-2022-1653506545, DEBIAN-CVE-2021-33515 and 5 more.