CVE-2022-24732 (published 2022-03-09T20:15Z)

Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing filtering mechanisms.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-613
cwe_name: Insufficient Session Expiration
description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
extended_description: 
            
            
            
         
         
cwe_id: CWE-324
cwe_name: Use of a Key Past its Expiration Date
description: The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
extended_description: While the expiration of keys does not necessarily ensure that they are compromised, it is a significant concern that keys which remain in use for prolonged periods of time have a decreasing probability of integrity. For this reason, it is important to replace keys within a period of time proportional to their strength.
         

Fix information:
repo_url: https://github.com/foxcpp/maddy
commit_details: repo_url: https://github.com/foxcpp/maddy
author: fox.cpp
author_date: 2022-03-06 15:52:36+03:00
msg: auth/pam: Check for account/password expiry

See GHSA-6cp7-g972-w9m9. Thanks Youssef Rebahi-Gilbert (ysf) for
reporting the issue.
repository: repo_url: https://github.com/foxcpp/maddy
repo_name: foxcpp/maddy
description: ✉️ Composable all-in-one mail server.
repo_language: Go
owner: foxcpp
file_changes: filename: pam.c
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,23 @@
+//+build libpam
+
+/*
+Maddy Mail Server - Composable all-in-one email server.
+Copyright © 2019-2022 Max Mazurov <fox.cpp@disroot.org>, Maddy Mail Server contributors
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 #define _POSIX_C_SOURCE 200809L
 #include <stdio.h>
 #include <stdlib.h>
@@ -46,6 +66,19 @@ struct error_obj run_pam_auth(const char *username, char *password) {
         return ret_val;
     }
 
+    status = pam_acct_mgmt(local_auth, PAM_SILENT|PAM_DISALLOW_NULL_AUTHTOK);
+    if (status != PAM_SUCCESS) {
+        struct error_obj ret_val;
+        if (status == PAM_AUTH_ERR || status == PAM_USER_UNKNOWN || status == PAM_NEW_AUTHTOK_REQD) {
+            ret_val.status = 1;
+        } else {
+            ret_val.status = 2;
+        }
+        ret_val.func_name = "pam_acct_mgmt";
+        ret_val.error_msg = pam_strerror(local_auth, status);
+        return ret_val;
+    }
+
     status = pam_end(local_auth, status);
     if (status != PAM_SUCCESS) {
         struct error_obj ret_val;

programming_language: C
filename: pam.c
change_type: ModificationType.MODIFY
diff: @@ -2,7 +2,7 @@
 
 /*
 Maddy Mail Server - Composable all-in-one email server.
-Copyright © 2019-2020 Max Mazurov <fox.cpp@disroot.org>, Maddy Mail Server contributors
+Copyright © 2019-2022 Max Mazurov <fox.cpp@disroot.org>, Maddy Mail Server contributors
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -66,6 +66,19 @@ struct error_obj run_pam_auth(const char *username, char *password) {
         return ret_val;
     }
 
+    status = pam_acct_mgmt(local_auth, PAM_SILENT|PAM_DISALLOW_NULL_AUTHTOK);
+    if (status != PAM_SUCCESS) {
+        struct error_obj ret_val;
+        if (status == PAM_AUTH_ERR || status == PAM_USER_UNKNOWN || status == PAM_NEW_AUTHTOK_REQD) {
+            ret_val.status = 1;
+        } else {
+            ret_val.status = 2;
+        }
+        ret_val.func_name = "pam_acct_mgmt";
+        ret_val.error_msg = pam_strerror(local_auth, status);
+        return ret_val;
+    }
+
     status = pam_end(local_auth, status);
     if (status != PAM_SUCCESS) {
         struct error_obj ret_val;

programming_language: C