PT-2025-40955 · Dovecot+1 · Dovecot Imap Server+1

Published 2025-10-05 · Updated 2025-12-10 · CVE-2025-30189

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dovecot IMAP Server versions 2.4.0 through 2.4.1

Description When cache is enabled, some passdb/userdb drivers incorrectly cache all users with the same cache key, leading to incorrect cached information being used. After a successful cached login, all subsequent logins are treated as the same user. This issue affects systems using oauth2 passdb, passwd passdb, userdb, or passwd userdb.

Recommendations Upgrade to Dovecot IMAP Server version 2.4.2 or later. Disable auth cache globally or for the impacted passdb/userdb drivers.

Fix

Weakness Enumeration

CWE-1250

Related Identifiers

AZL-69833

AZL-69835

CVE-2025-30189

DSA-6019-1

OPENSUSE-SU-2025-20113-1

OPENSUSE-SU-2025:15676-1

OPENSUSE-SU-2025:20113-1

SUSE-SU-2025:21159-1

SUSE-SU-2025_21159-1

Affected Products

Dovecot Imap Server

Suse

References · 29

• https://osv.dev/vulnerability/SUSE-SU-2025:21159-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2025-30189 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025-20113-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-30189 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-6019-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-30189 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-30189 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30189 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:20113-1 · Vendor Advisory
• https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15676-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-30189 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-69833 · Vendor Advisory
• https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2025/oxdc-adv-2025-0001.json · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-30189 · Security Note