CVE-2021-29157: 
Dovecot vulnerability analysis and mitigation

CVE-2021-29157 is a path traversal vulnerability discovered in Dovecot versions before 2.3.15, disclosed on June 28, 2021. The vulnerability affects the OAuth2 authentication mechanism when using local JWT validation with the posix fs driver. This security issue allows an attacker with local filesystem access to trick OAuth2 authentication into using an HS256 validation key from an attacker-controlled location (NVD, Dovecot Security).

The vulnerability stems from improper escaping of kid and azp fields in JWT tokens during OAuth2 authentication. When using local JWT validation with the posix fs driver, the vulnerability allows for path traversal using '../' sequences. The CVSS v3.1 base score is 5.5 (MEDIUM) according to NVD assessment with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, while MITRE assessed it at 7.5 (HIGH) with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N (NVD).

If exploited, this vulnerability could allow a local attacker to validate tokens using arbitrary keys, potentially leading to unauthorized authentication and access to user emails. The vulnerability specifically impacts the confidentiality of the system by allowing access to sensitive authentication mechanisms (Openwall, Fedora Update).

The vulnerability requires local filesystem access to exploit. An attacker can trigger the vulnerability by placing a base64 encoded HS256 shared key in a location readable by dovecot and using '../../../../../location/to/path' as the key azp. This allows the attacker to forge tokens and authenticate as any valid user (Openwall).

The vulnerability was fixed in Dovecot version 2.3.15. System administrators are advised to upgrade to this version or later to address the security issue. The fix includes proper escaping of kid and azp fields in JWT tokens (Dovecot Security, Gentoo Security).