# CVE-2021-33515: dovecot: Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind CVE-2021-33515 is fixed in 19 products on 1 platform, first by dovecot-auth-lua 1:2.3.7.2-1ubuntu3.4, released June 21, 2021. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2021-33515 - Priority: Routine - CVSS: 4.8 (Moderate) - EPSS: 0.0285 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jun 21, 2021 ## Description Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. The following packages have been upgraded to a later upstream version: dovecot (2.3.16). (BZ#1980014) Security Fix(es): * dovecot: plaintext commands injection (CVE-2021-33515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes linked from the References section. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | dovecot RHEL 8 | 1:2.3.16-2.el8 | [RHSA-2022:1950](https://patchblox.com/security/data/fix/linux/rhsa-2022-1950.md) | May 10, 2022 | | Linux | dovecot almalinux 8 | 1:2.3.16-2.el8 | [ALSA-2022:1950](https://patchblox.com/security/data/fix/linux/alsa-2022-1950.md) | May 10, 2022 | | Linux | dovecot ol 8 | 1:2.3.16-2.el8 | [ELSA-2022-1950](https://patchblox.com/security/data/fix/linux/elsa-2022-1950.md) | May 17, 2022 | | Linux | dovecot rocky 8 | 1:2.3.16-2.el8 | [RLSA-2022:1950](https://patchblox.com/security/data/fix/linux/rlsa-2022-1950.md) | May 10, 2022 | | Linux | dovecot-auth-lua Ubuntu 20.04 LTS (focal) | 1:2.3.7.2-1ubuntu3.4 | [dovecot-auth-lua 1:2.3.7.2-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dovecot-auth-lua-1-2.3.7.2-1ubuntu3.4.md) | Jun 21, 2021 | | Linux | dovecot-core Ubuntu 20.04 LTS (focal) | 1:2.3.7.2-1ubuntu3.4 | [dovecot-core 1:2.3.7.2-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dovecot-core-1-2.3.7.2-1ubuntu3.4.md) | Jun 21, 2021 | | Linux | dovecot-devel RHEL 8 | 1:2.3.16-2.el8 | [RHSA-2022:1950](https://patchblox.com/security/data/fix/linux/rhsa-2022-1950.md) | May 10, 2022 | | Linux | dovecot-devel almalinux 8 | 1:2.3.16-2.el8 | [ALSA-2022:1950](https://patchblox.com/security/data/fix/linux/alsa-2022-1950.md) | May 10, 2022 | | Linux | dovecot-devel ol 8 | 1:2.3.16-2.el8 | [ELSA-2022-1950](https://patchblox.com/security/data/fix/linux/elsa-2022-1950.md) | May 17, 2022 | | Linux | dovecot-gssapi Ubuntu 20.04 LTS (focal) | 1:2.3.7.2-1ubuntu3.4 | [dovecot-gssapi 1:2.3.7.2-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dovecot-gssapi-1-2.3.7.2-1ubuntu3.4.md) | Jun 21, 2021 | | Linux | dovecot-imapd Ubuntu 20.04 LTS (focal) | 1:2.3.7.2-1ubuntu3.4 | [dovecot-imapd 1:2.3.7.2-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dovecot-imapd-1-2.3.7.2-1ubuntu3.4.md) | Jun 21, 2021 | | Linux | dovecot-ldap Ubuntu 20.04 LTS (focal) | 1:2.3.7.2-1ubuntu3.4 | [dovecot-ldap 1:2.3.7.2-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dovecot-ldap-1-2.3.7.2-1ubuntu3.4.md) | Jun 21, 2021 | | Linux | dovecot-lmtpd Ubuntu 20.04 LTS (focal) | 1:2.3.7.2-1ubuntu3.4 | [dovecot-lmtpd 1:2.3.7.2-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dovecot-lmtpd-1-2.3.7.2-1ubuntu3.4.md) | Jun 21, 2021 | | Linux | dovecot-lucene Ubuntu 20.04 LTS (focal) | 1:2.3.7.2-1ubuntu3.4 | [dovecot-lucene 1:2.3.7.2-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dovecot-lucene-1-2.3.7.2-1ubuntu3.4.md) | Jun 21, 2021 | | Linux | dovecot-managesieved Ubuntu 20.04 LTS (focal) | 1:2.3.7.2-1ubuntu3.4 | [dovecot-managesieved 1:2.3.7.2-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dovecot-managesieved-1-2.3.7.2-1ubuntu3.4.md) | Jun 21, 2021 | | Linux | dovecot-mysql RHEL 8 | 1:2.3.16-2.el8 | [RHSA-2022:1950](https://patchblox.com/security/data/fix/linux/rhsa-2022-1950.md) | May 10, 2022 | | Linux | dovecot-mysql Ubuntu 20.04 LTS (focal) | 1:2.3.7.2-1ubuntu3.4 | [dovecot-mysql 1:2.3.7.2-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dovecot-mysql-1-2.3.7.2-1ubuntu3.4.md) | Jun 21, 2021 | | Linux | dovecot-mysql almalinux 8 | 1:2.3.16-2.el8 | [ALSA-2022:1950](https://patchblox.com/security/data/fix/linux/alsa-2022-1950.md) | May 10, 2022 | | Linux | dovecot-mysql ol 8 | 1:2.3.16-2.el8 | [ELSA-2022-1950](https://patchblox.com/security/data/fix/linux/elsa-2022-1950.md) | May 17, 2022 | | Linux | dovecot-pgsql RHEL 8 | 1:2.3.16-2.el8 | [RHSA-2022:1950](https://patchblox.com/security/data/fix/linux/rhsa-2022-1950.md) | May 10, 2022 | | Linux | dovecot-pgsql Ubuntu 20.04 LTS (focal) | 1:2.3.7.2-1ubuntu3.4 | [dovecot-pgsql 1:2.3.7.2-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dovecot-pgsql-1-2.3.7.2-1ubuntu3.4.md) | Jun 21, 2021 | | Linux | dovecot-pgsql almalinux 8 | 1:2.3.16-2.el8 | [ALSA-2022:1950](https://patchblox.com/security/data/fix/linux/alsa-2022-1950.md) | May 10, 2022 | | Linux | dovecot-pgsql ol 8 | 1:2.3.16-2.el8 | [ELSA-2022-1950](https://patchblox.com/security/data/fix/linux/elsa-2022-1950.md) | May 17, 2022 | | Linux | dovecot-pigeonhole RHEL 8 | 1:2.3.16-2.el8 | [RHSA-2022:1950](https://patchblox.com/security/data/fix/linux/rhsa-2022-1950.md) | May 10, 2022 | | Linux | dovecot-pigeonhole almalinux 8 | 1:2.3.16-2.el8 | [ALSA-2022:1950](https://patchblox.com/security/data/fix/linux/alsa-2022-1950.md) | May 10, 2022 | | Linux | dovecot-pigeonhole ol 8 | 1:2.3.16-2.el8 | [ELSA-2022-1950](https://patchblox.com/security/data/fix/linux/elsa-2022-1950.md) | May 17, 2022 | | Linux | dovecot-pop3d Ubuntu 20.04 LTS (focal) | 1:2.3.7.2-1ubuntu3.4 | [dovecot-pop3d 1:2.3.7.2-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dovecot-pop3d-1-2.3.7.2-1ubuntu3.4.md) | Jun 21, 2021 | | Linux | dovecot-sieve Ubuntu 20.04 LTS (focal) | 1:2.3.7.2-1ubuntu3.4 | [dovecot-sieve 1:2.3.7.2-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dovecot-sieve-1-2.3.7.2-1ubuntu3.4.md) | Jun 21, 2021 | | Linux | dovecot-solr Ubuntu 20.04 LTS (focal) | 1:2.3.7.2-1ubuntu3.4 | [dovecot-solr 1:2.3.7.2-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dovecot-solr-1-2.3.7.2-1ubuntu3.4.md) | Jun 21, 2021 | | Linux | dovecot-sqlite Ubuntu 20.04 LTS (focal) | 1:2.3.7.2-1ubuntu3.4 | [dovecot-sqlite 1:2.3.7.2-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dovecot-sqlite-1-2.3.7.2-1ubuntu3.4.md) | Jun 21, 2021 | | Linux | dovecot-submissiond Ubuntu 20.04 LTS (focal) | 1:2.3.7.2-1ubuntu3.4 | [dovecot-submissiond 1:2.3.7.2-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dovecot-submissiond-1-2.3.7.2-1ubuntu3.4.md) | Jun 21, 2021 | | Linux | mail-stack-delivery Ubuntu 20.04 LTS (focal) | 1:2.3.7.2-1ubuntu3.4 | [mail-stack-delivery 1:2.3.7.2-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-mail-stack-delivery-1-2.3.7.2-1ubuntu3.4.md) | Jun 21, 2021 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.