Description
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | 1:2.3.19.1+dfsg1-2 | — |
| Debian 13 | dovecot | 1:2.3.19.1+dfsg1-2 | — |
| Debian 12 | dovecot | 1:2.3.19.1+dfsg1-2 | — |
| Debian 10 | dovecot | 1:2.3.4.1-5+deb10u7 | DLA-3122-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | dovecot | 1:2.3.16+dfsg1-3ubuntu2.1 | USN-5509-1 |
| Ubuntu 20.04 LTS | dovecot | 1:2.3.7.2-1ubuntu3.6 | USN-5509-1 |
| Ubuntu 18.04 LTS | dovecot | 1:2.2.33.2-1ubuntu4.8 | USN-5509-1 |
| Ubuntu 16.04 LTS | dovecot | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | dovecot | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | dovecot +4 | 1:2.3.16-7.el9 | RHSA-2022:8208 |
| RHEL 8 | dovecot +4 | 1:2.3.16-3.el8 | RHSA-2022:7623 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | dovecot +4 | 1:2.3.16-7.el9 | ALSA-2022:8208 |
| AlmaLinux 8 | dovecot +4 | 1:2.3.16-3.el8 | ALSA-2022:7623 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | dovecot | 1:2.3.16-7.el9 | RLSA-2022:8208 |
| Rocky Linux 8 | dovecot | 1:2.3.16-3.el8 | RLSA-2022:7623 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | dovecot23 | 2.3.15-150200.62.1 | SUSE-SU-2022:2448-1 |
| SLES 15 SP3 | dovecot23 | 2.3.15-150200.62.1 | SUSE-SU-2022:2448-1 |
| SLES 15 SP2 | dovecot23 | 2.3.15-150200.62.1 | SUSE-SU-2022:2448-1 |
| SLES 15 SP1 | dovecot23 | 2.3.15-150100.31.1 | SUSE-SU-2022:2432-1 |
| SLES 15 | dovecot23 | 2.3.15-150000.4.42.1 | SUSE-SU-2022:2431-1 |
Show 19 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | dovecot22 | 2.2.31-19.29.1 | SUSE-SU-2022:2618-1 |
| SLES 12 SP4 | dovecot22 | 2.2.31-19.29.1 | SUSE-SU-2022:2618-1 |
| SLES 12 SP3 | dovecot22 | 2.2.31-19.29.1 | SUSE-SU-2022:2618-1 |
| SLES 12 SP2 | dovecot22 | 2.2.31-19.29.1 | SUSE-SU-2022:2618-1 |
| SLES for SAP 15 SP2 | dovecot23 | 2.3.15-150200.62.1 | SUSE-SU-2022:2448-1 |
| SLES for SAP 15 SP1 | dovecot23 | 2.3.15-150100.31.1 | SUSE-SU-2022:2432-1 |
| SLES for SAP 15 | dovecot23 | 2.3.15-150000.4.42.1 | SUSE-SU-2022:2431-1 |
| SLES for SAP 12 SP5 | dovecot22 | 2.2.31-19.29.1 | SUSE-SU-2022:2618-1 |
| SLES for SAP 12 SP4 | dovecot22 | 2.2.31-19.29.1 | SUSE-SU-2022:2618-1 |
| SLE HPC 15 SP2 | dovecot23 | 2.3.15-150200.62.1 | SUSE-SU-2022:2448-1 |
| SLE HPC 15 SP1 | dovecot23 | 2.3.15-150100.31.1 | SUSE-SU-2022:2432-1 |
| SLE HPC 15 | dovecot23 | 2.3.15-150000.4.42.1 | SUSE-SU-2022:2431-1 |
| SUSE OpenStack Cloud Crowbar 9 | dovecot22 | 2.2.31-19.29.1 | SUSE-SU-2022:2618-1 |
| SUSE OpenStack Cloud 9 | dovecot22 | 2.2.31-19.29.1 | SUSE-SU-2022:2618-1 |
| SUSE Manager Server 4.1 | dovecot23 | 2.3.15-150200.62.1 | SUSE-SU-2022:2448-1 |
| SUSE Manager Retail Branch Server 4.1 | dovecot23 | 2.3.15-150200.62.1 | SUSE-SU-2022:2448-1 |
| SUSE Manager Proxy 4.1 | dovecot23 | 2.3.15-150200.62.1 | SUSE-SU-2022:2448-1 |
| SUSE Enterprise Storage 7 | dovecot23 | 2.3.15-150200.62.1 | SUSE-SU-2022:2448-1 |
| SUSE Enterprise Storage 6 | dovecot23 | 2.3.15-150100.31.1 | SUSE-SU-2022:2432-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | dovecot23 | 2.3.15-150200.62.1 | SUSE-SU-2022:2448-1 |
| openSUSE Leap 15.3 | dovecot23 | 2.3.15-150200.62.1 | SUSE-SU-2022:2448-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | dovecot | 2.3.19.1-r5 | — |
| Alpine v3.23 | dovecot | 2.3.19.1-r5 | — |
| Alpine v3.22 | dovecot | 2.3.19.1-r5 | — |
| Alpine v3.21 | dovecot | 2.3.19.1-r5 | — |
| Alpine v3.20 | dovecot | 2.3.19.1-r5 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | dovecot | 2.3.19.1-r5 | — |
| Alpine v3.18 | dovecot | 2.3.19.1-r5 | — |
| Alpine v3.17 | dovecot | 2.3.19.1-r5 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | dovecot +4 | 1:2.2.36-6.amzn2.1.1 | ALAS2-2023-2365 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | dovecot | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | dovecot | 2.3.20-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | dovecot +4 | 1:2.3.16-7.0.1.el9 | ELSA-2022-8208 |
| Oracle Linux 8 | dovecot +4 | 1:2.3.16-3.el8 | ELSA-2022-7623 |
Advisories 16
- ALSA-2022:8208 Moderate: dovecot security and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2022:7623 Moderate: dovecot security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:7623 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2022:8208 Red Hat Security Advisory: dovecot security and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-5509-1 dovecot vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-3122-1 dovecot - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:8208 Moderate: dovecot security and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2022:7623 Moderate: dovecot security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2022:2431-1 Security update for dovecot23 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2618-1 Security update for dovecot22 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2448-1 Security update for dovecot23 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2432-1 Security update for dovecot23 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0589 Dovecot: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Dec 4, 2023
- ALAS2-2023-2365 Moderate: dovecot security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 4, 2023
- ELSA-2022-8208 Moderate: dovecot security and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 22, 2022
- ELSA-2022-7623 Moderate: dovecot security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 15, 2022