Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The auth.ldap module constructs LDAP search filters and DN strings by directly interpolating user-supplied usernames via strings.ReplaceAll() without any LDAP filter escaping. An attacker who can reach the SMTP submission (AUTH PLAIN) or IMAP LOGIN interface can inject arbitrary LDAP filter expressions through the username field, enabling identity spoofing, LDAP directory enumeration, and attribute value extraction. The go-ldap/ldap/v3 library—already imported in the same file—provides ldap.EscapeFilter() specifically for this purpose, but it is never called. Patched version Upgrade to maddy 0.9.3. Details Affected file: internal/auth/ldap/ldap.go Three locations substitute the raw, attacker-controlled username into LDAP filter or DN strings with no escaping: 1. Lookup() — line 228 (filter injection) 2. AuthPlain() — line 255 (DN template injection) 3. AuthPlain() — line 260 (filter injection) The go-ldap/ldap/v3 library (v3.4.10, imported at line 17) provides…
Recommended action: Upgrade to 0.9.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact maddy 0.2.0 - 0.6.2 allows a full authentication bypass if SASL authorization username is specified when using the PLAIN authentication mechanisms. Instead of validating the specified authorization username, it is accepted as is after checking the credentials for the authentication username. Patches maddy 0.6.3 includes the fix for the bug. Workarounds There is no way to fix the issue without upgrading. References Commit that introduced the vulnerable code: https://github.com/foxcpp/maddy/commit/55a91a37b71210f34f98f4d327c30308fe24399a Fix: https://github.com/foxcpp/maddy/commit/9f58cb64b39cdc01928ec463bdb198c4c2313a9c
Recommended action: Upgrade to 0.6.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Any configuration on any maddy version <0.5.4 using auth.pam is affected. No password expiry or account expiry checking is done when authenticating using PAM. Patches Patch is available as part of the 0.5.4 release. Workarounds If /etc/shadow authentication is used, it is possible to replace auth.pam with auth.shadow which is not affected. It is possible to blacklist expired accounts via existing filtering mechanisms (e.g. authmap to invalid accounts in storage.imapsql). References https://github.com/foxcpp/maddy/blob/3412e59a2c92106e194fa69f2f1017c020037c9c/internal/auth/pam/pam.c https://linux.die.net/man/3/pamacctmgmt For more information If you have any questions or comments about this advisory: Open an issue in https://github.com/foxcpp/maddy Email fox.cpp@disroot.org
Recommended action: Upgrade to 0.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Broken or Risky Cryptographic Algorithm exists in Max Mazurov Maddy before 0.5.2, which is an unnecessary risk that may result in the exposure of sensitive information.
Recommended action: Upgrade to 0.5.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This vulnerability affects maddy 0.5.1, 0.5.0 users using auth.shadow module and an extremely outdated system that still allows MD5 hashes in /etc/shadows. Patches Patch is available as part of the 0.5.2 release. Workarounds Ensure MD5 hashes are not present in /etc/shadow.
Recommended action: Upgrade to 0.5.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Anyone using storage.blob.s3 introduced in 0.5.0 with storage.imapsql. Patches The relevant commit is pushed to master and will be included in the 0.5.1 release. No special handling of the issue has been done due to the small amount of affected users. Workarounds None. References Original report: https://github.com/foxcpp/maddy/issues/395 Fix: https://github.com/foxcpp/maddy/commit/07c8495ee4394fabbf5aac4df8aebeafb2fb29d8
Recommended action: Upgrade to 0.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.