Attestkeep
Langue : Français
S'inscrire

Vulnérabilités / CVE-2026-27851

critique

CVE-2026-27851

dovecot: Dovecot: SQL/LDAP injection via incorrect safe filter interpretation with variable expansion

Publiée Modifiée CWE 235, 89
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.

Sévérité par source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (élevée), Ubuntu (moyenne).

Description

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

Paquets affectés et versions corrigées

SourcePaquetCorrigé en
alpine 3.23dovecot2.4.4-r0
alpine 3.24dovecot2.4.4-r0
alpine edgedovecot2.4.4-r0
debian 13dovecot1:2.4.1+dfsg1-6+deb13u6
debian 14dovecot1:2.4.4+dfsg1-1
rapidfort alpine 3.20dovecot2.4.4-r0
rapidfort alpine 3.21dovecot2.4.4-r0
rapidfort alpine 3.22dovecot2.4.4-r0
rapidfort alpine 3.23dovecot2.4.4-r0
rapidfort debian 12dovecot1:2.4.1+dfsg1-6+deb13u6, 1:2.4.4+dfsg1-1
rapidfort debian 13dovecot1:2.4.1+dfsg1-6+deb13u6, 1:2.4.4+dfsg1-1
rapidfort fedora 43dovecot, dovecot-devel, dovecot-mysql et 2 autres1:2.4.4-1.fc43
Afficher les 23 entrées de 15 sources
SourcePaquetCorrigé en
alpine 3.23dovecot2.4.4-r0
alpine 3.24dovecot2.4.4-r0
alpine edgedovecot2.4.4-r0
debian 13dovecot1:2.4.1+dfsg1-6+deb13u6
debian 14dovecot1:2.4.4+dfsg1-1
rapidfort alpine 3.20dovecot2.4.4-r0
rapidfort alpine 3.21dovecot2.4.4-r0
rapidfort alpine 3.22dovecot2.4.4-r0
rapidfort alpine 3.23dovecot2.4.4-r0
rapidfort debian 12dovecot1:2.4.1+dfsg1-6+deb13u6, 1:2.4.4+dfsg1-1
rapidfort debian 13dovecot1:2.4.1+dfsg1-6+deb13u6, 1:2.4.4+dfsg1-1
rapidfort fedora 43dovecot1:2.4.4-1.fc43
rapidfort fedora 43dovecot-devel1:2.4.4-1.fc43
rapidfort fedora 43dovecot-mysql1:2.4.4-1.fc43
rapidfort fedora 43dovecot-pgsql1:2.4.4-1.fc43
rapidfort fedora 43dovecot-pigeonhole1:2.4.4-1.fc43
Red Hatdovecotpas de correctif indiqué
Red Hatdovecot-develpas de correctif indiqué
Red Hatdovecot-mysqlpas de correctif indiqué
Red Hatdovecot-pgsqlpas de correctif indiqué
Red Hatdovecot-pigeonholepas de correctif indiqué
ubuntu 25.10dovecot1:2.4.1+dfsg1-5ubuntu4.2
ubuntu 26.04dovecot1:2.4.2+dfsg1-3ubuntu2.1

Références

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.