2.1 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.0004 Low
EPSS
Percentile
5.1%
dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora,
uses world-readable permissions for dovecot.conf, which allows local users
to obtain the ssl_key_password parameter value.
Author | Note |
---|---|
jdstrand | marking as low because the default configuration doesn’t set ssl_key_password |
mdeslaur | file permissions can’t be changed because of “deliver” Red Hat backported a new “!include_try” directive to the config file that allows including a second permission-protected config file (taken from 1.1.7) Debian says “by default this file doesnt containt sensitive information and administrator changing this should ensure on its own that the mode is secure” after discussion with kees and jdstrand, here’s our plan: TODO: add a warning to the default conf file. on second thought, not worth risking a conf file prompt, so marking as ignored |