CVE-2022-30550

一、漏洞信息
 漏洞编号：[CVE-2022-30550](https://nvd.nist.gov/vuln/detail/CVE-2022-30550)
 漏洞归属组件：[dovecot](https://gitee.com/src-openeuler/dovecot)
 漏洞归属的版本：2.3.10.1,2.3.15
 CVSS V3.0分值：
  BaseScore：8.8 High
  Vector：CVSS：3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
 漏洞公开时间：2022-07-18 03:15:00
 漏洞创建时间：2022-09-17 17:00:04
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-30550
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://www.openwall.com/lists/oss-security/2022/07/08/1 |  |
| nvd | https://dovecot.org/security |  |
| nvd | https://www.dovecot.org/download/ |  |
| nvd | https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html |  |
| redhat | https://access.redhat.com/security/cve/CVE-2022-30550 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-30550 | https://bugzilla.suse.com/show_bug.cgi?id=1201267 |
| suse_bugzilla | https://seclists.org/oss-sec/2022/q3/33 | https://bugzilla.suse.com/show_bug.cgi?id=1201267 |
| redhat_bugzilla | https://github.com/dovecot/core/compare/7bad6a24%5E..a1022072.patch | https://bugzilla.redhat.com/show_bug.cgi?id=2105070 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:7623 | https://bugzilla.redhat.com/show_bug.cgi?id=2105070 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:8208 | https://bugzilla.redhat.com/show_bug.cgi?id=2105070 |
| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-30550 | https://bugzilla.redhat.com/show_bug.cgi?id=2105070 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30550 | https://ubuntu.com/security/CVE-2022-30550 |
| ubuntu | https://www.openwall.com/lists/oss-security/2022/07/06/9 | https://ubuntu.com/security/CVE-2022-30550 |
| ubuntu | https://ubuntu.com/security/notices/USN-5509-1 | https://ubuntu.com/security/CVE-2022-30550 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-30550 | https://ubuntu.com/security/CVE-2022-30550 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-30550 | https://ubuntu.com/security/CVE-2022-30550 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-30550 | https://ubuntu.com/security/CVE-2022-30550 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2022-30550 |
| cve_search |  | https://www.openwall.com/lists/oss-security/2022/07/08/1 |
| cve_search |  | https://dovecot.org/security |
| cve_search |  | https://www.dovecot.org/download/ |
| cve_search |  | https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html |
| mageia |  | http://advisories.mageia.org/MGASA-2022-0296.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| oracle |  | https://www.oracle.com/security-alerts/linuxbulletinoct2022.html |
| nvd | https://lists.debian.org/debian-lts-announce/2022/09/msg00032.html |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-30550 |  |
| suse_bugzilla | https://seclists.org/oss-sec/2022/q3/33 |  |
| redhat_bugzilla | https://github.com/dovecot/core/compare/7bad6a24%5E..a1022072.patch |  |
| redhat_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2105070 |  |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30550 |  |
| ubuntu | https://www.openwall.com/lists/oss-security/2022/07/06/9 |  |
| ubuntu | https://ubuntu.com/security/notices/USN-5509-1 |  |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-30550 |  |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-30550 |  |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-30550 |  |
| debian | https://security-tracker.debian.org/tracker/CVE-2022-30550 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
      在 2.3.20 之前的 Dovecot 2.2 和 2.3 的 auth 组件中发现了一个问题。当存在两个具有相同驱动程序和参数设置的 passdb 配置条目时，错误的 username_filter 和机制设置可能会应用于 passdb 定义。 这些错误应用的设置可能会导致意外的安全配置，并且可能允许在某些配置中进行权限提升。 该文档不建议不要使用具有相同驱动程序和参数设置的 passdb 定义。 一种这样的配置是管理员希望对普通用户和主用户使用相同的 PAM 配置或 passwd 文件，但使用 username_filter 设置来限制哪些用户能够成为主用户。  
 openEuler评分：
  6.8
 Vector：CVSS：3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(2.3.15):受影响
2.openEuler-20.03-LTS-SP3(2.3.15):受影响
3.openEuler-22.03-LTS(2.3.15):受影响
4.openEuler-22.03-LTS-Next(2.3.15):受影响
5.openEuler-22.09(2.3.15):受影响
6.master(2.3.15):受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(2.3.15):否
2.openEuler-20.03-LTS-SP3(2.3.15):否
3.openEuler-22.03-LTS(2.3.15):否
4.openEuler-22.03-LTS-Next(2.3.15):否
5.openEuler-22.09(2.3.15):否
6.master(2.3.15):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2022-1994

src-openEuler/dovecot

内容风险标识

评论 (15)

src-openEuler/dovecot .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2022-30550

评论 (15)

搜索帮助

src-openEuler/dovecot