{"document":{"aggregate_severity":{"text":"HIGH"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"text":"Copyright © Open-Xchange GmbH. All rights reserved.","tlp":{"label":"GREEN","url":"https://www.first.org/tlp/"}},"lang":"en-US","notes":[{"category":"legal_disclaimer","text":"This content is licensed under the Creative Commons Attribution-NoDerivatives 4.0 International License (https://creativecommons.org/licenses/by-nd/4.0/). If you distribute this content, you must provide attribution to Open-Xchange GmbH and provide a link to the original. You may not distribute a modified version of this content.","title":"Terms of Use"}],"publisher":{"category":"vendor","name":"Open-Xchange GmbH","namespace":"https://open-xchange.com/"},"references":[{"category":"self","summary":"Canonical CSAF document","url":"https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2025/oxdc-adv-2025-0001.json"},{"category":"self","summary":"Markdown representation","url":"https://documentation.open-xchange.com/dovecot/security/advisories/md/2025/oxdc-adv-2025-0001.md"},{"category":"self","summary":"HTML representation","url":"https://documentation.open-xchange.com/dovecot/security/advisories/html/2025/oxdc-adv-2025-0001.html"},{"category":"self","summary":"Plain-text representation","url":"https://documentation.open-xchange.com/dovecot/security/advisories/txt/2025/oxdc-adv-2025-0001.txt"}],"title":"OX Dovecot Pro Security Advisory OXDC-ADV-2025-0001","tracking":{"current_release_date":"2025-11-27T00:00:00+00:00","generator":{"date":"2025-11-27T10:32:50+00:00","engine":{"name":"OX CSAF","version":"1.0.0"}},"id":"OXDC-ADV-2025-0001","initial_release_date":"2025-10-31T00:00:00+00:00","revision_history":[{"date":"2025-10-31T00:00:00+00:00","number":"1","summary":"Initial release"},{"date":"2025-10-31T00:00:00+00:00","number":"2","summary":"Public release"},{"date":"2025-10-31T00:00:00+00:00","number":"3","summary":"Fix versions"},{"date":"2025-10-31T00:00:00+00:00","number":"4","summary":"Public release"},{"date":"2025-10-31T00:00:00+00:00","number":"5","summary":"Public release"},{"date":"2025-11-27T00:00:00+00:00","number":"6","summary":"Public release"},{"date":"2025-11-27T00:00:00+00:00","number":"7","summary":"Public release"}],"status":"final","version":"7"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"2.4.0","product":{"name":"Dovecot CE 2.4.0","product_id":"OXDC-CE_2.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:dovecot:2.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"2.4.2","product":{"name":"Dovecot CE 2.4.2","product_id":"OXDC-CE_2.4.2","product_identification_helper":{"cpe":"cpe:2.3:a:open-xchange:dovecot:2.4.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Dovecot CE"}],"category":"vendor","name":"Open-Xchange GmbH"}]},"vulnerabilities":[{"acknowledgments":[{"names":["Erik  <erik@broadlux.com>"]}],"cve":"CVE-2025-30189","cwe":{"id":"CWE-1250","name":"Improper Preservation of Consistency Between Independent Representations of Shared State"},"discovery_date":"2025-07-25T01:04:36+03:00","ids":[{"system_name":"JIRA OX Bug","text":"DOV-7830"}],"notes":[{"category":"description","text":"When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users."}],"product_status":{"first_fixed":["OXDC-CE_2.4.2"],"last_affected":["OXDC-CE_2.4.0"]},"remediations":[{"category":"vendor_fix","date":"2025-10-29T00:00:00+00:00","details":"Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers.","product_ids":["OXDC-CE_2.4.0"]}],"scores":[{"cvss_v3":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["OXDC-CE_2.4.0"]}],"threats":[{"category":"impact","details":"After cached login, all subsequent logins are for same user."},{"category":"exploit_status","details":"No publicly available exploits are known."}],"title":"v2.4 regression: auth cache broken with several passdb / userdb"}]}