Improper Initialization in Fetchmail - CVE-2021-36386

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU55426

Improper Initialization in Fetchmail - CVE-2021-36386

Published: July 29, 2021


Vulnerability identifier: #VU55426
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-36386
CWE-ID: CWE-665
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improper initialization when logging error messages. A local user can trigger an error condition on the fetchmail side and gain access to sensitive information or perform a denial of service (DoS) attack.


Affected software

Fetchmail
Gentoo Linux
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Module for Basesystem
openEuler
Fedora
fetchmail
fetchmail-debuginfo
fetchmail-debugsource
fetchmailconf
fetchmail-help
net-mail/fetchmail
fetchmail (Red Hat package)

How to mitigate CVE-2021-36386

Install updates from vendor's website.

Fetchmail - update to 6.4.20
fetchmail - addressed in versions 6.3.26-13.12.1, 6.3.26-13.18.1, 6.3.26-20.14.1, 6.4.22-20.20.1
fetchmail-debuginfo - addressed in versions 6.3.26-13.12.1, 6.3.26-13.18.1, 6.3.26-20.14.1, 6.4.22-20.20.1
fetchmail-debugsource - addressed in versions 6.3.26-13.12.1, 6.3.26-13.18.1, 6.3.26-20.14.1, 6.4.22-20.20.1
fetchmailconf - addressed in versions 6.3.26-13.12.1, 6.3.26-13.18.1, 6.3.26-20.14.1, 6.4.22-20.20.1
fetchmail - update to 6.4.20-1
fetchmail-debuginfo - update to 6.4.20-1
fetchmail-debugsource - update to 6.4.20-1
fetchmail-help - update to 6.4.20-1
fetchmail - addressed in versions 6.4.20-1.fc33, 6.4.20-1.fc34
net-mail/fetchmail - update to 6.4.22
fetchmail (Red Hat package) - update to 6.4.24-1.el8
fetchmail - update to 6.4.24-1.0.1

External References

Related Security Bulletins