PT-2025-40955 · Dovecot+1 · Dovecot Imap Server+1

CVE-2025-30189 · Publicado 2025-10-05 · Atualizado 2025-12-10

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dovecot IMAP Server versions 2.4.0 through 2.4.1

Description When cache is enabled, some passdb/userdb drivers incorrectly cache all users with the same cache key, leading to incorrect cached information being used. After a successful cached login, all subsequent logins are treated as the same user. This issue affects systems using oauth2 passdb, passwd passdb, userdb, or passwd userdb.

Recommendations Upgrade to Dovecot IMAP Server version 2.4.2 or later. Disable auth cache globally or for the impacted passdb/userdb drivers.

Correção

Enumeração de Fraquezas

CWE-1250

Identificadores relacionados

AZL-69833

AZL-69835

CVE-2025-30189

DSA-6019-1

OPENSUSE-SU-2025-20113-1

OPENSUSE-SU-2025:15676-1

OPENSUSE-SU-2025:20113-1

SUSE-SU-2025:21159-1

SUSE-SU-2025_21159-1

Produtos afetados

Dovecot Imap Server

Suse

Referências · 29

• https://osv.dev/vulnerability/SUSE-SU-2025:21159-1 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2025/Oct/29 · Nota
• https://osv.dev/vulnerability/ALPINE-CVE-2025-30189 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-30189 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2025-20113-1 · Aviso do Fabricante
• https://t.me/CVEtracker/36277 · Publicação no Telegram
• https://ubuntu.com/security/CVE-2025-30189 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-6019-1 · Aviso do Fabricante
• https://twitter.com/jedisct1/status/1983611701594665326 · Publicação no Twitter
• https://security-tracker.debian.org/tracker/CVE-2025-30189 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2025/10/29/4 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-30189 · Aviso do Fabricante
• https://bugzilla.suse.com/1252839 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-30189 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2025:20113-1 · Aviso do Fabricante