CVE-2021-33515
published 2021-06-28CVE-2021-33515: The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an…
PriorityP427medium4.8CVSS 3.1
AVNACHPRNUINSUCLILAN
EPSS
2.84%
85.2th percentile
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | dovecot | < dovecot 1:2.3.13+dfsg1-2 (bookworm) | dovecot 1:2.3.13+dfsg1-2 (bookworm) |
| dovecot | dovecot | < 2.3.14.1 | 2.3.14.1 |
| dovecot | dovecot | >= 0 < 1:2.3.13+dfsg1-2 | 1:2.3.13+dfsg1-2 |
| dovecot | dovecot | >= 0 < 1:2.3.13+dfsg1-2 | 1:2.3.13+dfsg1-2 |
| dovecot | dovecot | >= 0 < 1:2.3.13+dfsg1-2 | 1:2.3.13+dfsg1-2 |
| dovecot | dovecot | >= 0 < 1:2.3.13+dfsg1-2 | 1:2.3.13+dfsg1-2 |
| dovecot | dovecot | >= 0 < 1:2.3.7.2-1ubuntu3.4 | 1:2.3.7.2-1ubuntu3.4 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cbl2_dovecot_2.3.20-1_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
osv5.5MEDIUM
vendor_ubuntu7.5HIGH
vendor_debian4.8MEDIUM
vendor_msrc4.8MEDIUM
vendor_redhat4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
dovecot: plaintext commands injection
vendor_redhat·2021-06-21·CVSS 4.8
CVE-2021-33515 [MEDIUM] CWE-77 dovecot: plaintext commands injection
dovecot: plaintext commands injection
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
It was found that dovecot could still accept plaintext commands while the STARTTLS negotiation process is ongoing. This could allow an active person in the middle, with valid credentials on dovecot, to, for example, steal confidential data such as the client's emails and passwords.
Package: dovecot (Red Hat Enterprise Linux 6) - Out of support scope
Package: dovecot (Red Hat Enterprise Linux 7) - Not affected
Package: dovecot (Red Hat Enterprise Linux 9) - Affected
Ubuntu
Dovecot vulnerabilities
vendor_ubuntu·2021-06-21·CVSS 7.5
CVE-2021-29157 [HIGH] Dovecot vulnerabilities
Title: Dovecot vulnerabilities
Summary: Several security issues were fixed in Dovecot.
Kirin discovered that Dovecot incorrectly escaped kid and azp fields in JWT
tokens. A local attacker could possibly use this issue to validate tokens
using arbitrary keys. This issue only affected Ubuntu 20.10 and Ubuntu
21.04. (CVE-2021-29157)
Fabian Ising and Damian Poddebniak discovered that Dovecot incorrectly
handled STARTTLS when using the SMTP submission service. A remote attacker
could possibly use this issue to inject plaintext commands before
STARTTLS negotiation. (CVE-2021-33515)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
vendor_msrc·2021-06-08·CVSS 4.8
CVE-2021-33515 [MEDIUM] CWE-77 The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner:
Debian
CVE-2021-33515: dovecot - The submission service in Dovecot before 2.3.15 allows STARTTLS command injectio...
vendor_debian·2021·CVSS 4.8
CVE-2021-33515 [MEDIUM] CVE-2021-33515: dovecot - The submission service in Dovecot before 2.3.15 allows STARTTLS command injectio...
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
Scope: local
bookworm: resolved (fixed in 1:2.3.13+dfsg1-2)
bullseye: resolved (fixed in 1:2.3.13+dfsg1-2)
forky: resolved (fixed in 1:2.3.13+dfsg1-2)
sid: resolved (fixed in 1:2.3.13+dfsg1-2)
trixie: resolved (fixed in 1:2.3.13+dfsg1-2)
GHSA
MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade
ghsa·2026-04-18
CVE-2021-23993 [MEDIUM] CWE-74 MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade
MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade
### Summary
A STARTTLS Response Injection vulnerability in MailKit allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in `SmtpStream`, `ImapStream`, and `Pop3Stream` is not flushed when the underlying stream is replaced with `SslStream` during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. This is the same vulnerability class as CVE-2021-23993 (Thunderbird), CVE-2021-33515 (Dovecot), and CVE-2011-0411 (Postfix).
### Details
The `Stream` pr
GHSA
GHSA-pwmq-cvcm-r5p2: The submission service in Dovecot before 2
ghsa_unreviewed·2022-05-24
CVE-2021-33515 [MEDIUM] CWE-77 GHSA-pwmq-cvcm-r5p2: The submission service in Dovecot before 2
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
OSV
CVE-2021-33515: The submission service in Dovecot before 2
osv·2021-06-28·CVSS 4.8
CVE-2021-33515 [MEDIUM] CVE-2021-33515: The submission service in Dovecot before 2
The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.
OSV
dovecot vulnerabilities
osv·2021-06-21·CVSS 5.5
CVE-2021-29157 [MEDIUM] dovecot vulnerabilities
dovecot vulnerabilities
Kirin discovered that Dovecot incorrectly escaped kid and azp fields in JWT
tokens. A local attacker could possibly use this issue to validate tokens
using arbitrary keys. This issue only affected Ubuntu 20.10 and Ubuntu
21.04. (CVE-2021-29157)
Fabian Ising and Damian Poddebniak discovered that Dovecot incorrectly
handled STARTTLS when using the SMTP submission service. A remote attacker
could possibly use this issue to inject plaintext commands before
STARTTLS negotiation. (CVE-2021-33515)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://dovecot.org/securityhttps://lists.debian.org/debian-lts-announce/2022/09/msg00032.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/https://security.gentoo.org/glsa/202107-41https://www.openwall.com/lists/oss-security/2021/06/28/2https://dovecot.org/securityhttps://lists.debian.org/debian-lts-announce/2022/09/msg00032.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/https://security.gentoo.org/glsa/202107-41https://www.openwall.com/lists/oss-security/2021/06/28/2
2021-06-28
Published