CVE-2021-33515

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.3.15

Description The issue is related to the submission service in Dovecot, which allows STARTTLS command injection in lib-smtp. This can lead to sensitive information being redirected to an attacker-controlled address. The vulnerability is also associated with incorrect neutralization of special elements in output used by the incoming component, potentially allowing a remote attacker to disclose user credentials.

Recommendations For versions prior to 2.3.15, update to version 2.3.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the submission service until a patch is applied. Avoid using the STARTTLS command in lib-smtp until the issue is resolved.