PT-2022-16837 · Maddy+1 · Maddy+1

Sysf · Published 2022-03-07 · Updated 2022-03-17 · CVE-2022-24732

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions maddy versions prior to 0.5.4

Description The issue concerns the Maddy Mail Server, an open source SMTP compatible email server. It does not implement password expiry or account expiry checking when authenticating using PAM. This affects configurations using auth.pam on versions prior to 0.5.4. Users are advised to upgrade to address the issue. For those unable to upgrade, manually removing expired accounts via existing filtering mechanisms is recommended.

Recommendations For versions prior to 0.5.4, upgrade to version 0.5.4 or later to resolve the issue. As a temporary workaround, consider replacing auth.pam with auth.shadow if /etc/shadow authentication is used. Alternatively, blacklist expired accounts via existing filtering mechanisms, such as using auth map to invalid accounts in storage.imapsql.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

CWE-324

Related Identifiers

CVE-2022-24732

GHSA-6CP7-G972-W9M9

Affected Products

Maddy Mail Server

Maddy

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24732.json · Exploit
• https://github.com/foxcpp/maddy/commit/7ee6a39c6a1939b376545f030a5efd6f90913583 · Patch
• https://osv.dev/vulnerability/GHSA-6cp7-g972-w9m9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24732 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24732 · Vendor Advisory
• https://github.com/foxcpp/maddy · Note
• https://github.com/foxcpp/maddy/releases/tag/v0.5.4 · Note
• https://github.com/foxcpp/maddy/security/advisories/GHSA-6cp7-g972-w9m9 · Note
• https://t.me/cibsecurity/38626 · Telegram Post