{"id":"CVE-2022-30550","aliases":["ALPINE-CVE-2022-30550","ALSA-2022:7623","ALSA-2022:8208","AZL-10311","AZL-44649","CLSA-2022-1659635856","CLSA-2022-1659635964","DEBIAN-CVE-2022-30550","DLA-3122-1","EUVD-2022-52409","GHSA-cch8-vp96-g53m","MGASA-2022-0296","OESA-2022-1994","RHSA-2022:7623","RHSA-2022:8208","RLSA-2022:7623","RLSA-2022:8208","SUSE-SU-2022:2431-1","SUSE-SU-2022:2432-1","SUSE-SU-2022:2448-1","SUSE-SU-2022:2618-1","UBUNTU-CVE-2022-30550","USN-5509-1"],"status":"published","title":"An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two...","description":"An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0229,"percentile":0.83349,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2022-07-07T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"dovecot","fixed_in":["2.3.19.1-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"dovecot","fixed_in":["2.3.19.1-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"dovecot","fixed_in":["2.3.19.1-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"dovecot","fixed_in":["2.3.19.1-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"dovecot","fixed_in":["2.3.19.1-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"dovecot","fixed_in":["2.3.19.1-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"dovecot","fixed_in":["2.3.19.1-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dovecot","fixed_in":["2.3.19.1-r5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"dovecot","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"dovecot-devel","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"dovecot-mysql","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"dovecot-pgsql","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"dovecot-pigeonhole","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"dovecot","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"dovecot-devel","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"dovecot-mysql","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"dovecot-pgsql","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"dovecot-pigeonhole","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"dovecot","fixed_in":["2.3.20-1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"dovecot","fixed_in":["1:2.3.8-9.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"dovecot-devel","fixed_in":["1:2.3.8-9.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"dovecot-mysql","fixed_in":["1:2.3.8-9.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"dovecot-pgsql","fixed_in":["1:2.3.8-9.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"dovecot-pigeonhole","fixed_in":["1:2.3.8-9.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"dovecot","fixed_in":["1:2.3.8-9.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"dovecot-devel","fixed_in":["1:2.3.8-9.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"dovecot-mysql","fixed_in":["1:2.3.8-9.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"dovecot-pgsql","fixed_in":["1:2.3.8-9.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"dovecot-pigeonhole","fixed_in":["1:2.3.8-9.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"dovecot","fixed_in":["1:2.3.19.1+dfsg1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dovecot","fixed_in":["1:2.3.19.1+dfsg1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dovecot","fixed_in":["1:2.3.19.1+dfsg1-2"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"dovecot","fixed_in":["2.3.17.1-1.2.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"dovecot","fixed_in":["2.3.15-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"dovecot","fixed_in":["2.3.15-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"dovecot","fixed_in":["2.3.15-5.oe2203"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-debuginfo","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-debugsource","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-mysql","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-mysql-debuginfo","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pgsql","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pgsql-debuginfo","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pigeonhole","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pigeonhole-debuginfo","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-debuginfo","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-debugsource","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-devel","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-mysql-debuginfo","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-pgsql-debuginfo","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-pigeonhole-debuginfo","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-debuginfo","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-debugsource","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-mysql","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-mysql-debuginfo","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pgsql","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pgsql-debuginfo","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pigeonhole","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pigeonhole-debuginfo","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-debuginfo","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-debugsource","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-devel","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-mysql-debuginfo","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-pgsql-debuginfo","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-pigeonhole-debuginfo","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"dovecot","fixed_in":["1:2.3.16-3.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"dovecot","fixed_in":["1:2.3.16-7.el9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"dovecot23","fixed_in":["2.3.15-150000.4.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"dovecot23","fixed_in":["2.3.15-150000.4.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"dovecot23","fixed_in":["2.3.15-150000.4.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"dovecot23","fixed_in":["2.3.15-150000.4.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"dovecot23","fixed_in":["2.3.15-150100.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"dovecot23","fixed_in":["2.3.15-150100.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"dovecot23","fixed_in":["2.3.15-150100.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"dovecot23","fixed_in":["2.3.15-150100.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"dovecot23","fixed_in":["2.3.15-150100.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"dovecot23","fixed_in":["2.3.15-150100.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"dovecot23","fixed_in":["2.3.15-150200.62.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"dovecot23","fixed_in":["2.3.15-150200.62.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"dovecot23","fixed_in":["2.3.15-150200.62.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"dovecot23","fixed_in":["2.3.15-150200.62.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"dovecot23","fixed_in":["2.3.15-150200.62.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"dovecot23","fixed_in":["2.3.15-150200.62.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"dovecot23","fixed_in":["2.3.15-150200.62.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"dovecot23","fixed_in":["2.3.15-150200.62.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"dovecot23","fixed_in":["2.3.15-150200.62.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"dovecot23","fixed_in":["2.3.15-150200.62.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"dovecot23","fixed_in":["2.3.15-150200.62.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"dovecot23","fixed_in":["2.3.15-150200.62.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"dovecot23","fixed_in":["2.3.15-150200.62.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"dovecot22","fixed_in":["2.2.31-19.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"dovecot22","fixed_in":["2.2.31-19.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"dovecot22","fixed_in":["2.2.31-19.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"dovecot22","fixed_in":["2.2.31-19.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"dovecot22","fixed_in":["2.2.31-19.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"dovecot22","fixed_in":["2.2.31-19.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"dovecot22","fixed_in":["2.2.31-19.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"dovecot22","fixed_in":["2.2.31-19.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"dovecot22","fixed_in":["2.2.31-19.29.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"dovecot","fixed_in":["1:2.2.33.2-1ubuntu4.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"dovecot","fixed_in":["1:2.3.7.2-1ubuntu3.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"dovecot","fixed_in":["1:2.3.16+dfsg1-3ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3"},{"fixed":"2.3.19.1-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3"},{"fixed":"2.3.19.1-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3"},{"fixed":"2.3.19.1-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3"},{"fixed":"2.3.19.1-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3"},{"fixed":"2.3.19.1-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3"},{"fixed":"2.3.19.1-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3"},{"fixed":"2.3.19.1-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3"},{"fixed":"2.3.19.1-r5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.20-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.20-1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.8-9.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.8-9.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.8-9.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.8-9.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.8-9.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.8-9.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.8-9.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.8-9.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.8-9.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.8-9.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.19.1+dfsg1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.19.1+dfsg1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.19.1+dfsg1-2"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.4.1-5+deb10u7"}]}],"versions":["1:2.3.4.1-5","1:2.3.4.1-5+deb10u1","1:2.3.4.1-5+deb10u1~bpo9+1","1:2.3.4.1-5+deb10u2","1:2.3.4.1-5+deb10u3","1:2.3.4.1-5+deb10u4","1:2.3.4.1-5+deb10u5","1:2.3.4.1-5+deb10u6"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.17.1-1.2.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-5.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pigeonhole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dovecot-pigeonhole-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-3.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16-7.el9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150000.4.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150000.4.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150000.4.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150000.4.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150100.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150100.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150100.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150100.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150100.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150100.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150200.62.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150200.62.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150200.62.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150200.62.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150200.62.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150200.62.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150200.62.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150200.62.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150200.62.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150200.62.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150200.62.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150200.62.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"dovecot23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.15-150200.62.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"dovecot22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.31-19.29.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.1.7-7ubuntu3","1:2.2.9-1ubuntu1","1:2.2.9-1ubuntu2","1:2.2.9-1ubuntu2.1","1:2.2.9-1ubuntu2.3","1:2.2.9-1ubuntu2.4","1:2.2.9-1ubuntu2.5","1:2.2.9-1ubuntu2.6","1:2.2.9-1ubuntu2.6+esm1","1:2.2.9-1ubuntu2.6+esm2","1:2.2.9-1ubuntu2.6+esm3","1:2.2.9-1ubuntu2.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.2.18-2ubuntu2","1:2.2.22-1ubuntu1","1:2.2.22-1ubuntu2","1:2.2.22-1ubuntu2.1","1:2.2.22-1ubuntu2.2","1:2.2.22-1ubuntu2.3","1:2.2.22-1ubuntu2.4","1:2.2.22-1ubuntu2.6","1:2.2.22-1ubuntu2.7","1:2.2.22-1ubuntu2.8","1:2.2.22-1ubuntu2.9","1:2.2.22-1ubuntu2.10","1:2.2.22-1ubuntu2.11","1:2.2.22-1ubuntu2.12","1:2.2.22-1ubuntu2.13","1:2.2.22-1ubuntu2.14"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.33.2-1ubuntu4.8"}]}],"versions":["1:2.2.27-3ubuntu1","1:2.2.33.2-1ubuntu1","1:2.2.33.2-1ubuntu2","1:2.2.33.2-1ubuntu3","1:2.2.33.2-1ubuntu4","1:2.2.33.2-1ubuntu4.1","1:2.2.33.2-1ubuntu4.2","1:2.2.33.2-1ubuntu4.3","1:2.2.33.2-1ubuntu4.4","1:2.2.33.2-1ubuntu4.5","1:2.2.33.2-1ubuntu4.6","1:2.2.33.2-1ubuntu4.7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.7.2-1ubuntu3.6"}]}],"versions":["1:2.3.4.1-5ubuntu3","1:2.3.7.2-1ubuntu1","1:2.3.7.2-1ubuntu2","1:2.3.7.2-1ubuntu3","1:2.3.7.2-1ubuntu3.1","1:2.3.7.2-1ubuntu3.2","1:2.3.7.2-1ubuntu3.3","1:2.3.7.2-1ubuntu3.4","1:2.3.7.2-1ubuntu3.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16+dfsg1-3ubuntu2.1"}]}],"versions":["1:2.3.13+dfsg1-1ubuntu3","1:2.3.16+dfsg1-3ubuntu1","1:2.3.16+dfsg1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.33.2-1ubuntu4.8"}]}],"versions":["1:2.2.27-3ubuntu1","1:2.2.33.2-1ubuntu1","1:2.2.33.2-1ubuntu2","1:2.2.33.2-1ubuntu3","1:2.2.33.2-1ubuntu4","1:2.2.33.2-1ubuntu4.1","1:2.2.33.2-1ubuntu4.2","1:2.2.33.2-1ubuntu4.3","1:2.2.33.2-1ubuntu4.4","1:2.2.33.2-1ubuntu4.5","1:2.2.33.2-1ubuntu4.6","1:2.2.33.2-1ubuntu4.7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.7.2-1ubuntu3.6"}]}],"versions":["1:2.3.4.1-5ubuntu3","1:2.3.7.2-1ubuntu1","1:2.3.7.2-1ubuntu2","1:2.3.7.2-1ubuntu3","1:2.3.7.2-1ubuntu3.1","1:2.3.7.2-1ubuntu3.2","1:2.3.7.2-1ubuntu3.3","1:2.3.7.2-1ubuntu3.4","1:2.3.7.2-1ubuntu3.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dovecot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.16+dfsg1-3ubuntu2.1"}]}],"versions":["1:2.3.13+dfsg1-1ubuntu3","1:2.3.16+dfsg1-3ubuntu1","1:2.3.16+dfsg1-3ubuntu2"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"dovecot","product":"dovecot"}],"references":[{"url":"https://dovecot.org/security","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://www.dovecot.org/download/","tags":["x_transferred","Product","web"]},{"url":"https://www.openwall.com/lists/oss-security/2022/07/08/1","tags":["x_transferred","Mailing List","Patch","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://security.gentoo.org/glsa/202310-19","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30550","tags":["web","advisory"]},{"url":"https://www.dovecot.org/download"},{"url":"https://github.com/advisories/GHSA-cch8-vp96-g53m"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-30550","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:7623","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30550","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105070","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-7623.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8208","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-8208.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1659635856.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2022-1659635964.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30550.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-30550","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0296.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30618","tags":["report"]},{"url":"https://dovecot.org/pipermail/dovecot-news/2022-July/000477.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5509-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/532QM5GABOZURM72SXKWEPBBQKUHLQC3/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OQ5EW32AQSRSHPFQZM5W3PEYEKPBKGNA/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1994","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.7_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105070","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7623.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30550","tags":["advisory","report"]},{"url":"https://dovecot.org/pipermail/dovecot-news/2022-July/000478.html","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095399","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8208.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:7623","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:8208","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222431-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201267","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30550","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222432-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222448-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222618-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-30550","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2022/07/06/9","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-30550","description":"An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.","status":"published","published":"2022-07-17T00:00:00Z","modified":"2024-10-15T18:35:00.129Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:34:30.842561Z"}],"euvd":[{"id":"EUVD-2022-52409","description":"An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.","status":"published","published":"2022-07-17T00:00:00Z","modified":"2024-10-15T18:35:00Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:27:36.689661Z"}],"ghsa":[{"id":"GHSA-cch8-vp96-g53m","title":"An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two...","description":"An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.","status":"published","published":"2022-07-18T00:00:32Z","modified":"2024-10-15T21:31:34Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:58:30.303503Z"}],"nvd":[{"id":"CVE-2022-30550","description":"An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.","status":"published","published":"2022-07-17T19:15:18.54Z","modified":"2026-06-17T04:43:50.737Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:07:23.686531Z"}],"osv":[{"id":"ALPINE-CVE-2022-30550","description":"An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.","status":"published","published":"2022-07-17T19:15:18.54Z","modified":"2026-11-03T07:18:33.166609747Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"AZL-10311","title":"CVE-2022-30550 affecting package dovecot for versions less than 2.3.20-1","description":"An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.","status":"published","published":"2022-07-17T19:15:18Z","modified":"2026-04-21T04:18:19.381875Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:00.508704Z"},{"id":"AZL-44649","title":"CVE-2022-30550 affecting package dovecot 2.3.20-1","description":"An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.","status":"published","published":"2022-07-17T19:15:18Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CVE-2022-30550","description":"An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.","status":"published","published":"2022-07-17T00:00:00Z","modified":"2026-10-28T02:30:55.001812988Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"DEBIAN-CVE-2022-30550","description":"An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.","status":"published","published":"2022-07-17T19:15:18.54Z","modified":"2026-11-03T08:00:44.90270077Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"OESA-2022-1994","title":"dovecot security update","description":"Dovecot is an IMAP server for Linux/UNIX-like systemsa wrapper package that will just handle common things for all versioned dovecot packages.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.(CVE-2022-30550)","status":"published","published":"2022-10-14T11:05:18Z","modified":"2026-08-18T01:17:20.045378811Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2022:7623","title":"Red Hat Security Advisory: dovecot security update","status":"published","published":"2024-09-16T08:38:47Z","modified":"2026-06-26T12:22:18.756205802Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:8208","title":"Red Hat Security Advisory: dovecot security and enhancement update","status":"published","published":"2024-09-16T08:38:54Z","modified":"2026-06-26T12:22:06.466339824Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2022:7623","title":"Moderate: dovecot security update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. \n\nSecurity Fix(es):\n\n* dovecot: Privilege escalation when similar master and non-master passdbs are used (CVE-2022-30550)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.","status":"published","published":"2022-11-08T06:24:56Z","modified":"2026-02-04T10:00:04.343233Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2022:8208","title":"Moderate: dovecot security and enhancement update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. \n\nSecurity Fix(es):\n\n* dovecot: Privilege escalation when similar master and non-master passdbs are used (CVE-2022-30550)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.","status":"published","published":"2022-11-15T06:18:30Z","modified":"2026-02-05T03:30:08.422178Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-30550","description":"An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.","status":"published","published":"2022-07-07T00:00:00Z","modified":"2026-04-22T13:22:01.104639Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"ALSA-2022:7623","title":"Moderate: dovecot security update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. \n\nSecurity Fix(es):\n\n* dovecot: Privilege escalation when similar master and non-master passdbs are used (CVE-2022-30550)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-11-08T00:00:00Z","modified":"2026-10-29T11:01:07.793039128Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2022:8208","title":"Moderate: dovecot security and enhancement update","description":"Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. \n\nSecurity Fix(es):\n\n* dovecot: Privilege escalation when similar master and non-master passdbs are used (CVE-2022-30550)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-11-15T00:00:00Z","modified":"2026-10-29T11:31:18.041964867Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2022-1659635856","title":"Fixed CVE-2022-30550 in dovecot","description":"- CVE-2022-30550: fix handling passdbs with identical driver/args but different\n  mechanisms/username_filter","status":"published","published":"2022-08-04T17:57:36Z","modified":"2026-06-01T00:33:19.260168208Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1659635964","title":"Fixed CVE-2022-30550 in dovecot","description":"- CVE-2022-30550: fix handling passdbs with identical driver/args but different\n  mechanisms/username_filter","status":"published","published":"2022-08-04T17:59:24Z","modified":"2026-06-01T00:33:13.563281635Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"DLA-3122-1","title":"dovecot - security update","status":"published","published":"2022-09-27T00:00:00Z","modified":"2026-03-09T01:18:57.34964Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2022-0296","title":"Updated dovecot packages fix security vulnerability","description":"An issue was discovered in the auth component in Dovecot 2.2 and 2.3\nbefore 2.3.20. When two passdb configuration entries exist with the same\ndriver and args settings, incorrect username_filter and mechanism settings\ncan be applied to passdb definitions. These incorrectly applied settings\ncan lead to an unintended security configuration and can permit privilege\nescalation in certain configurations. The documentation does not advise\nagainst the use of passdb definitions that have the same driver and args\nsettings. One such configuration would be where an administrator wishes to\nuse the same PAM configuration or passwd file for both normal and master\nusers but use the username_filter setting to restrict which of the users\nis able to be a master user. (CVE-2022-30550)\n","status":"published","published":"2022-08-25T21:21:07Z","modified":"2026-04-16T04:41:32.209321542Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"SUSE-SU-2022:2431-1","title":"Security update for dovecot23","description":"This update for dovecot23 fixes the following issues:\n\n- CVE-2022-30550: Fixed privilege escalation in dovecot when similar master and non-master passdbs are used (bsc#1201267).\n","status":"published","published":"2022-07-18T16:55:39Z","modified":"2026-02-04T04:30:05.391904Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2432-1","title":"Security update for dovecot23","description":"This update for dovecot23 fixes the following issues:\n\n- CVE-2022-30550: Fixed privilege escalation in dovecot when similar master and non-master passdbs are used (bsc#1201267).\n","status":"published","published":"2022-07-18T16:56:18Z","modified":"2026-02-04T02:38:25.43387Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2448-1","title":"Security update for dovecot23","description":"This update for dovecot23 fixes the following issues:\n\n- CVE-2022-30550: Fixed privilege escalation in dovecot when similar master and non-master passdbs are used (bsc#1201267).\n","status":"published","published":"2022-07-20T08:15:41Z","modified":"2026-02-04T04:20:45.057038Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2618-1","title":"Security update for dovecot22","description":"This update for dovecot22 fixes the following issues:\n\n- CVE-2022-30550: Fixed privilege escalation in dovecot when similar master and non-master passdbs are used (bsc#1201267).\n","status":"published","published":"2022-08-01T09:57:29Z","modified":"2026-02-04T04:27:21.108971Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5509-1","title":"dovecot vulnerability","description":"Julian Brook discovered that Dovecot incorrectly handled multiple passdb\nconfiguration entries. In certain configurations, a remote attacker could\npossibly use this issue to escalate privileges.\n","status":"published","published":"2022-07-11T13:13:37Z","modified":"2026-04-27T16:13:34.472775Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}