CVE-2022-30550
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two...
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
- Record
CVE-2022-30550- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
- Record
CVE-2022-30550- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2022-52409
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
- Record
EUVD-2022-52409- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cch8-vp96-g53m
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two...
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
- Record
GHSA-cch8-vp96-g53m- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-30550
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
- Record
ALPINE-CVE-2022-30550- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVAZL-10311
CVE-2022-30550 affecting package dovecot for versions less than 2.3.20-1
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
- Record
AZL-10311- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 19 moreShow less
OSVAZL-44649
CVE-2022-30550 affecting package dovecot 2.3.20-1
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
- Record
AZL-44649- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSV
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
- Record
CVE-2022-30550- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-30550
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
- Record
DEBIAN-CVE-2022-30550- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVOESA-2022-1994
dovecot security update
Dovecot is an IMAP server for Linux/UNIX-like systemsa wrapper package that will just handle common things for all versioned dovecot packages.
Security Fix(es):
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.(CVE-2022-30550)
- Record
OESA-2022-1994- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2022:7623
Red Hat Security Advisory: dovecot security update
- Record
RHSA-2022:7623- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2022:8208
Red Hat Security Advisory: dovecot security and enhancement update
- Record
RHSA-2022:8208- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRLSA-2022:7623
Moderate: dovecot security update
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.
Security Fix(es):
- dovecot: Privilege escalation when similar master and non-master passdbs are used (CVE-2022-30550)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.
- Record
RLSA-2022:7623- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRLSA-2022:8208
Moderate: dovecot security and enhancement update
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.
Security Fix(es):
- dovecot: Privilege escalation when similar master and non-master passdbs are used (CVE-2022-30550)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.
- Record
RLSA-2022:8208- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-30550
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
- Record
UBUNTU-CVE-2022-30550- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2022:7623 No score
Moderate: dovecot security update
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.
Security Fix(es):
- dovecot: Privilege escalation when similar master and non-master passdbs are used (CVE-2022-30550)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2022:7623- Updated
- 2026-11-02
OSVALSA-2022:8208 No score
Moderate: dovecot security and enhancement update
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.
Security Fix(es):
- dovecot: Privilege escalation when similar master and non-master passdbs are used (CVE-2022-30550)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2022:8208- Updated
- 2026-11-02
OSVCLSA-2022-1659635856 No score
Fixed CVE-2022-30550 in dovecot
- CVE-2022-30550: fix handling passdbs with identical driver/args but different mechanisms/username_filter
- Record
CLSA-2022-1659635856- Updated
- 2026-11-02
OSVCLSA-2022-1659635964 No score
Fixed CVE-2022-30550 in dovecot
- CVE-2022-30550: fix handling passdbs with identical driver/args but different mechanisms/username_filter
- Record
CLSA-2022-1659635964- Updated
- 2026-11-02
OSVMGASA-2022-0296 No score
Updated dovecot packages fix security vulnerability
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user. (CVE-2022-30550)
- Record
MGASA-2022-0296- Updated
- 2026-11-02
OSVSUSE-SU-2022:2431-1 No score
Security update for dovecot23
This update for dovecot23 fixes the following issues:
- CVE-2022-30550: Fixed privilege escalation in dovecot when similar master and non-master passdbs are used (bsc#1201267).
- Record
SUSE-SU-2022:2431-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:2432-1 No score
Security update for dovecot23
This update for dovecot23 fixes the following issues:
- CVE-2022-30550: Fixed privilege escalation in dovecot when similar master and non-master passdbs are used (bsc#1201267).
- Record
SUSE-SU-2022:2432-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:2448-1 No score
Security update for dovecot23
This update for dovecot23 fixes the following issues:
- CVE-2022-30550: Fixed privilege escalation in dovecot when similar master and non-master passdbs are used (bsc#1201267).
- Record
SUSE-SU-2022:2448-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:2618-1 No score
Security update for dovecot22
This update for dovecot22 fixes the following issues:
- CVE-2022-30550: Fixed privilege escalation in dovecot when similar master and non-master passdbs are used (bsc#1201267).
- Record
SUSE-SU-2022:2618-1- Updated
- 2026-11-02
OSVUSN-5509-1 No score
dovecot vulnerability
Julian Brook discovered that Dovecot incorrectly handled multiple passdb configuration entries. In certain configurations, a remote attacker could possibly use this issue to escalate privileges.
- Record
USN-5509-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dovecotAlpine:v3.17 |
2.3 up to 2.3.19.1-r5 | 2.3.19.1-r5 |
dovecotAlpine:v3.18 |
2.3 up to 2.3.19.1-r5 | 2.3.19.1-r5 |
dovecotAlpine:v3.19 |
2.3 up to 2.3.19.1-r5 | 2.3.19.1-r5 |
dovecotAlpine:v3.20 |
2.3 up to 2.3.19.1-r5 | 2.3.19.1-r5 |
dovecotAlpine:v3.21 |
2.3 up to 2.3.19.1-r5 | 2.3.19.1-r5 |
dovecotAlpine:v3.22 |
2.3 up to 2.3.19.1-r5 | 2.3.19.1-r5 |
dovecotAlpine:v3.23 |
2.3 up to 2.3.19.1-r5 | 2.3.19.1-r5 |
dovecotAlpine:v3.24 |
2.3 up to 2.3.19.1-r5 | 2.3.19.1-r5 |
dovecotAlmaLinux:8 |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-develAlmaLinux:8 |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
Show 99 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dovecot-mysqlAlmaLinux:8 |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-pgsqlAlmaLinux:8 |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-pigeonholeAlmaLinux:8 |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecotAlmaLinux:9 |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-develAlmaLinux:9 |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-mysqlAlmaLinux:9 |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-pgsqlAlmaLinux:9 |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-pigeonholeAlmaLinux:9 |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecotAzure Linux:2 |
before 2.3.20-1 | 2.3.20-1 |
dovecotAzure Linux:3 |
through 2.3.20-1 | None known |
dovecotTuxCare:CentOS:8.4 |
before 1:2.3.8-9.el8.tuxcare.els2 | 1:2.3.8-9.el8.tuxcare.els2 |
dovecot-develTuxCare:CentOS:8.4 |
before 1:2.3.8-9.el8.tuxcare.els2 | 1:2.3.8-9.el8.tuxcare.els2 |
dovecot-mysqlTuxCare:CentOS:8.4 |
before 1:2.3.8-9.el8.tuxcare.els2 | 1:2.3.8-9.el8.tuxcare.els2 |
dovecot-pgsqlTuxCare:CentOS:8.4 |
before 1:2.3.8-9.el8.tuxcare.els2 | 1:2.3.8-9.el8.tuxcare.els2 |
dovecot-pigeonholeTuxCare:CentOS:8.4 |
before 1:2.3.8-9.el8.tuxcare.els2 | 1:2.3.8-9.el8.tuxcare.els2 |
dovecotTuxCare:CentOS:8.5 |
before 1:2.3.8-9.el8.tuxcare.els2 | 1:2.3.8-9.el8.tuxcare.els2 |
dovecot-develTuxCare:CentOS:8.5 |
before 1:2.3.8-9.el8.tuxcare.els2 | 1:2.3.8-9.el8.tuxcare.els2 |
dovecot-mysqlTuxCare:CentOS:8.5 |
before 1:2.3.8-9.el8.tuxcare.els2 | 1:2.3.8-9.el8.tuxcare.els2 |
dovecot-pgsqlTuxCare:CentOS:8.5 |
before 1:2.3.8-9.el8.tuxcare.els2 | 1:2.3.8-9.el8.tuxcare.els2 |
dovecot-pigeonholeTuxCare:CentOS:8.5 |
before 1:2.3.8-9.el8.tuxcare.els2 | 1:2.3.8-9.el8.tuxcare.els2 |
dovecotDebian:12 |
before 1:2.3.19.1+dfsg1-2 | 1:2.3.19.1+dfsg1-2 |
dovecotDebian:13 |
before 1:2.3.19.1+dfsg1-2 | 1:2.3.19.1+dfsg1-2 |
dovecotDebian:14 |
before 1:2.3.19.1+dfsg1-2 | 1:2.3.19.1+dfsg1-2 |
dovecotDebian:10 From an advisory covering 2 CVEs |
before 1:2.3.4.1-5+deb10u7, plus listed versions 1:2.3.4.1-51:2.3.4.1-5+deb10u11:2.3.4.1-5+deb10u1~bpo9+11:2.3.4.1-5+deb10u21:2.3.4.1-5+deb10u31:2.3.4.1-5+deb10u41:2.3.4.1-5+deb10u51:2.3.4.1-5+deb10u6 |
1:2.3.4.1-5+deb10u7 |
dovecotMageia:8 |
before 2.3.17.1-1.2.mga8 | 2.3.17.1-1.2.mga8 |
dovecotopenEuler:20.03-LTS-SP1 |
before 2.3.15-3.oe1 | 2.3.15-3.oe1 |
dovecotopenEuler:20.03-LTS-SP3 |
before 2.3.15-5.oe1 | 2.3.15-5.oe1 |
dovecotopenEuler:22.03-LTS |
before 2.3.15-5.oe2203 | 2.3.15-5.oe2203 |
dovecotRed Hat:enterprise_linux:8::appstream |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-debuginfoRed Hat:enterprise_linux:8::appstream |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-debugsourceRed Hat:enterprise_linux:8::appstream |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-mysqlRed Hat:enterprise_linux:8::appstream |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-mysql-debuginfoRed Hat:enterprise_linux:8::appstream |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-pgsqlRed Hat:enterprise_linux:8::appstream |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-pgsql-debuginfoRed Hat:enterprise_linux:8::appstream |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-pigeonholeRed Hat:enterprise_linux:8::appstream |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-pigeonhole-debuginfoRed Hat:enterprise_linux:8::appstream |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecotRed Hat:enterprise_linux:8::crb |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-debuginfoRed Hat:enterprise_linux:8::crb |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-debugsourceRed Hat:enterprise_linux:8::crb |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-develRed Hat:enterprise_linux:8::crb |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-mysql-debuginfoRed Hat:enterprise_linux:8::crb |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-pgsql-debuginfoRed Hat:enterprise_linux:8::crb |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecot-pigeonhole-debuginfoRed Hat:enterprise_linux:8::crb |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecotRed Hat:enterprise_linux:9::appstream |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-debuginfoRed Hat:enterprise_linux:9::appstream |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-debugsourceRed Hat:enterprise_linux:9::appstream |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-mysqlRed Hat:enterprise_linux:9::appstream |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-mysql-debuginfoRed Hat:enterprise_linux:9::appstream |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-pgsqlRed Hat:enterprise_linux:9::appstream |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-pgsql-debuginfoRed Hat:enterprise_linux:9::appstream |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-pigeonholeRed Hat:enterprise_linux:9::appstream |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-pigeonhole-debuginfoRed Hat:enterprise_linux:9::appstream |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecotRed Hat:enterprise_linux:9::crb |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-debuginfoRed Hat:enterprise_linux:9::crb |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-debugsourceRed Hat:enterprise_linux:9::crb |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-develRed Hat:enterprise_linux:9::crb |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-mysql-debuginfoRed Hat:enterprise_linux:9::crb |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-pgsql-debuginfoRed Hat:enterprise_linux:9::crb |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot-pigeonhole-debuginfoRed Hat:enterprise_linux:9::crb |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecotRocky Linux:8 |
before 1:2.3.16-3.el8 | 1:2.3.16-3.el8 |
dovecotRocky Linux:9 |
before 1:2.3.16-7.el9 | 1:2.3.16-7.el9 |
dovecot23SUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 2.3.15-150000.4.42.1 | 2.3.15-150000.4.42.1 |
dovecot23SUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 2.3.15-150000.4.42.1 | 2.3.15-150000.4.42.1 |
dovecot23SUSE:Linux Enterprise Server 15-LTSS |
before 2.3.15-150000.4.42.1 | 2.3.15-150000.4.42.1 |
dovecot23SUSE:Linux Enterprise Server for SAP Applications 15 |
before 2.3.15-150000.4.42.1 | 2.3.15-150000.4.42.1 |
dovecot23SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS |
before 2.3.15-150100.31.1 | 2.3.15-150100.31.1 |
dovecot23SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 2.3.15-150100.31.1 | 2.3.15-150100.31.1 |
dovecot23SUSE:Linux Enterprise Server 15 SP1-BCL |
before 2.3.15-150100.31.1 | 2.3.15-150100.31.1 |
dovecot23SUSE:Linux Enterprise Server 15 SP1-LTSS |
before 2.3.15-150100.31.1 | 2.3.15-150100.31.1 |
dovecot23SUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 2.3.15-150100.31.1 | 2.3.15-150100.31.1 |
dovecot23SUSE:Enterprise Storage 6 |
before 2.3.15-150100.31.1 | 2.3.15-150100.31.1 |
dovecot23SUSE:Linux Enterprise Module for Server Applications 15 SP3 |
before 2.3.15-150200.62.1 | 2.3.15-150200.62.1 |
dovecot23SUSE:Linux Enterprise Module for Server Applications 15 SP4 |
before 2.3.15-150200.62.1 | 2.3.15-150200.62.1 |
dovecot23SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS |
before 2.3.15-150200.62.1 | 2.3.15-150200.62.1 |
dovecot23SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS |
before 2.3.15-150200.62.1 | 2.3.15-150200.62.1 |
dovecot23SUSE:Linux Enterprise Server 15 SP2-BCL |
before 2.3.15-150200.62.1 | 2.3.15-150200.62.1 |
dovecot23SUSE:Linux Enterprise Server 15 SP2-LTSS |
before 2.3.15-150200.62.1 | 2.3.15-150200.62.1 |
dovecot23SUSE:Linux Enterprise Server for SAP Applications 15 SP2 |
before 2.3.15-150200.62.1 | 2.3.15-150200.62.1 |
dovecot23SUSE:Manager Proxy 4.1 |
before 2.3.15-150200.62.1 | 2.3.15-150200.62.1 |
dovecot23SUSE:Manager Retail Branch Server 4.1 |
before 2.3.15-150200.62.1 | 2.3.15-150200.62.1 |
dovecot23SUSE:Manager Server 4.1 |
before 2.3.15-150200.62.1 | 2.3.15-150200.62.1 |
dovecot23SUSE:Enterprise Storage 7 |
before 2.3.15-150200.62.1 | 2.3.15-150200.62.1 |
dovecot23openSUSE:Leap 15.3 |
before 2.3.15-150200.62.1 | 2.3.15-150200.62.1 |
dovecot23openSUSE:Leap 15.4 |
before 2.3.15-150200.62.1 | 2.3.15-150200.62.1 |
dovecot22SUSE:OpenStack Cloud 9 |
before 2.2.31-19.29.1 | 2.2.31-19.29.1 |
dovecot22SUSE:OpenStack Cloud Crowbar 9 |
before 2.2.31-19.29.1 | 2.2.31-19.29.1 |
dovecot22SUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 2.2.31-19.29.1 | 2.2.31-19.29.1 |
dovecot22SUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 2.2.31-19.29.1 | 2.2.31-19.29.1 |
dovecot22SUSE:Linux Enterprise Server 12 SP2-BCL |
before 2.2.31-19.29.1 | 2.2.31-19.29.1 |
dovecot22SUSE:Linux Enterprise Server 12 SP3-BCL |
before 2.2.31-19.29.1 | 2.2.31-19.29.1 |
dovecot22SUSE:Linux Enterprise Server 12 SP4-LTSS |
before 2.2.31-19.29.1 | 2.2.31-19.29.1 |
dovecot22SUSE:Linux Enterprise Server 12 SP5 |
before 2.2.31-19.29.1 | 2.2.31-19.29.1 |
dovecot22SUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 2.2.31-19.29.1 | 2.2.31-19.29.1 |
dovecotUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1:2.1.7-7ubuntu31:2.2.9-1ubuntu11:2.2.9-1ubuntu21:2.2.9-1ubuntu2.11:2.2.9-1ubuntu2.3 Show 7 moreShow less1:2.2.9-1ubuntu2.41:2.2.9-1ubuntu2.51:2.2.9-1ubuntu2.61:2.2.9-1ubuntu2.6+esm11:2.2.9-1ubuntu2.6+esm21:2.2.9-1ubuntu2.6+esm31:2.2.9-1ubuntu2.6+esm4 |
None known |
dovecotUbuntu:16.04:LTS |
All versions, plus listed versions 1:2.2.18-2ubuntu21:2.2.22-1ubuntu11:2.2.22-1ubuntu21:2.2.22-1ubuntu2.11:2.2.22-1ubuntu2.2 Show 11 moreShow less1:2.2.22-1ubuntu2.31:2.2.22-1ubuntu2.41:2.2.22-1ubuntu2.61:2.2.22-1ubuntu2.71:2.2.22-1ubuntu2.81:2.2.22-1ubuntu2.91:2.2.22-1ubuntu2.101:2.2.22-1ubuntu2.111:2.2.22-1ubuntu2.121:2.2.22-1ubuntu2.131:2.2.22-1ubuntu2.14 |
None known |
dovecotUbuntu:18.04:LTS |
before 1:2.2.33.2-1ubuntu4.8, plus listed versions 1:2.2.27-3ubuntu11:2.2.33.2-1ubuntu11:2.2.33.2-1ubuntu21:2.2.33.2-1ubuntu31:2.2.33.2-1ubuntu4 Show 7 moreShow less1:2.2.33.2-1ubuntu4.11:2.2.33.2-1ubuntu4.21:2.2.33.2-1ubuntu4.31:2.2.33.2-1ubuntu4.41:2.2.33.2-1ubuntu4.51:2.2.33.2-1ubuntu4.61:2.2.33.2-1ubuntu4.7 |
1:2.2.33.2-1ubuntu4.8 |
dovecotUbuntu:20.04:LTS |
before 1:2.3.7.2-1ubuntu3.6, plus listed versions 1:2.3.4.1-5ubuntu31:2.3.7.2-1ubuntu11:2.3.7.2-1ubuntu21:2.3.7.2-1ubuntu31:2.3.7.2-1ubuntu3.1 Show 4 moreShow less1:2.3.7.2-1ubuntu3.21:2.3.7.2-1ubuntu3.31:2.3.7.2-1ubuntu3.41:2.3.7.2-1ubuntu3.5 |
1:2.3.7.2-1ubuntu3.6 |
dovecotUbuntu:22.04:LTS |
before 1:2.3.16+dfsg1-3ubuntu2.1, plus listed versions 1:2.3.13+dfsg1-1ubuntu31:2.3.16+dfsg1-3ubuntu11:2.3.16+dfsg1-3ubuntu2 |
1:2.3.16+dfsg1-3ubuntu2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-30550 is a high vulnerability (CVSS 8.8) in Dovecot, published July 7, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.29%, the 83rd percentile. Fixed in dovecot 2.3.19.1-r5.
References
dovecot.org/security
dovecot.org/download
openwall.com/lists/oss-security/2022/07/08/1
lists.debian.org/debian-lts-announce/2022/09/msg00032.html
security.gentoo.org/glsa/202310-19
nvd.nist.gov/vuln/detail/CVE-2022-30550
Show 39 moreShow less
github.com/advisories/GHSA-cch8-vp96-g53m
security.alpinelinux.org/vuln/CVE-2022-30550
access.redhat.com/errata/RHSA-2022:7623
bugzilla.redhat.com/2105070
errata.almalinux.org/8/ALSA-2022-7623.html
errata.cloudlinux.com/centos8.4-els/CLSA-2022-1659635856.html
security-tracker.debian.org/tracker/CVE-2022-30550
advisories.mageia.org/MGASA-2022-0296.html
bugs.mageia.org/show_bug.cgi?id=30618
ubuntu.com/security/notices/USN-5509-1
lists.opensuse.org/archives/list/[email protected]/thread/532QM5GABOZURM72SXKWEPBBQKUHLQC3
lists.fedoraproject.org/archives/list/[email protected]/thread/OQ5EW32AQSRSHPFQZM5W3PEYEKPBKGNA
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1994
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7623.json
cve.org/CVERecord?id=CVE-2022-30550
errata.rockylinux.org/RLSA-2022:7623
suse.com/support/update/announcement/2022/suse-su-20222431-1
bugzilla.suse.com/1201267