{"action":"Upgrade courier-authlib to 0.71.1-2 or later.","affected":[{"fixed":"0.71.1-2","introduced":"0"}],"component":"courier-authlib","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["0.71.1-2"],"id":"tcs_01M5NFHAT5AHTKYAFV7DGKS0YH","modified_at":"2026-10-23T18:03:59.221821857Z","published_at":"2021-03-15T05:15:12.467Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2021-28374","https://security-tracker.debian.org/tracker/CVE-2021-28374"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2021-28374#Debian:13/courier-authlib","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2021-28374"}],"summary":"The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowing an attacker to read user information."}