DEBIAN-CVE-2025-30189

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2025-30189

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-30189.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2025-30189

Upstream

CVE-2025-30189

Downstream

DSA-6019-1

Published

2025-10-31T09:15:47Z

Modified

2026-09-01T20:05:45Z

Severity

7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. After cached login, all subsequent logins are for same user. Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers. No publicly available exploits are known.

References

https://security-tracker.debian.org/tracker/CVE-2025-30189

Affected packages

Debian:13 / dovecot

Package

Name: dovecot
Purl: pkg:deb/debian/dovecot?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1:2.4.1+dfsg1-6+deb13u1

Affected versions

1:2.*

1:2.4.1+dfsg1-6

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-30189.json"

Debian:14 / dovecot