CVE-2023-27582: 
NixOS vulnerability analysis and mitigation

CVE-2023-27582 affects maddy, a composable all-in-one mail server, versions 0.2.0 through 0.6.2. The vulnerability was discovered and disclosed on March 13, 2023. The issue allows a full authentication bypass when using the PLAIN authentication mechanisms if a SASL authorization username is specified (GitHub Advisory).

The vulnerability stems from improper validation of SASL authorization usernames. When using the PLAIN authentication mechanism, the system accepts the specified authorization username as is after checking the credentials for the authentication username, without performing proper validation. This is classified as an Authentication Bypass vulnerability (CWE-287, CWE-305). The vulnerability has received a CVSS v3.1 base score of 9.8 CRITICAL with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows attackers to bypass authentication completely when using the PLAIN authentication mechanism. This could lead to unauthorized access to mail server functions with elevated privileges, potentially compromising the confidentiality and integrity of the mail system (GitHub Advisory).

The vulnerability has been fixed in maddy version 0.6.3. There are no known workarounds, and users must upgrade to the patched version to address the security issue. The fix involves proper validation of the SASL authorization username (GitHub Release).