# OXDC-ADV-2025-0001

## Metadata

* Document type: OX Dovecot Pro Security Advisory
* Publisher: Open-Xchange GmbH
* Classification: TLP:GREEN
* Publication Date: 2025-10-31
* Current version: 7
* Version status: Final
* Aggregate severity: High

## References

* [CSAF document](https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2025/oxdc-adv-2025-0001.json)
* [Advisory (.md)](https://documentation.open-xchange.com/dovecot/security/advisories/md/2025/oxdc-adv-2025-0001.md)
* [Advisory (.html)](https://documentation.open-xchange.com/dovecot/security/advisories/html/2025/oxdc-adv-2025-0001.html)
* [Advisory (.txt)](https://documentation.open-xchange.com/dovecot/security/advisories/txt/2025/oxdc-adv-2025-0001.txt)

## Vulnerabilities

### CVE-2025-30189: v2.4 regression: auth cache broken with several passdb / userdb

* CVE reference: [CVE-2025-30189](https://www.cve.org/CVERecord?id=CVE-2025-30189)
* Internal reference: DOV-7830
* CWE: CWE-1250 (Improper Preservation of Consistency Between Independent Representations of Shared State)
* Discovery date: 2025-07-25
* Researcher credits: Erik  <erik@broadlux.com>

#### Description

When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users.

#### Product status

##### Last affected

| Products | CVSS-Vector | CVSS Base Score |
|-|-|-|
| OX Dovecot Pro core 2.4.0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | 7.4 |

#### Threats

##### Impact

After cached login, all subsequent logins are for same user.

##### Exploit status

No publicly available exploits are known.

#### Remediation

##### Vendor fix (2025-10-29)

###### For products

* OX Dovecot Pro core 2.4.2

Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers.