Inadequate Encryption Strength in Fetchmail - CVE-2021-39272

Vulnerability identifier: #VU57578

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-39272

CWE-ID: CWE-326

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH. A remote attacker with ability to intercept network traffic can gain access to sensitive information.

Fetchmail
Gentoo Linux
SUSE CaaS Platform
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Desktop Applications
openEuler
Fedora
fetchmail
fetchmail-debuginfo
fetchmail-debugsource
fetchmailconf
net-mail/fetchmail
fetchmail-help
fetchmail (Red Hat package)

Install updates from vendor's website.

Fetchmail - update to 6.4.22
fetchmail - addressed in versions 6.3.26-13.15.1, 6.3.26-20.17.1, 6.4.22-20.20.1
fetchmail-debuginfo - addressed in versions 6.3.26-13.15.1, 6.3.26-20.17.1, 6.4.22-20.20.1
fetchmail-debugsource - addressed in versions 6.3.26-13.15.1, 6.3.26-20.17.1, 6.4.22-20.20.1
fetchmailconf - addressed in versions 6.3.26-13.15.1, 6.3.26-20.17.1, 6.4.22-20.20.1
net-mail/fetchmail - update to 6.4.22
fetchmail-help - update to 6.4.22-1
fetchmail - update to 6.4.22-1
fetchmail-debuginfo - update to 6.4.22-1
fetchmail-debugsource - update to 6.4.22-1
fetchmail - addressed in versions 6.4.22-1.fc33, 6.4.22-1.fc34, 6.4.22-1.fc35
fetchmail (Red Hat package) - update to 6.4.24-1.el8
fetchmail - update to 6.4.24-1.0.1

• https://nostarttls.secvuln.info/
• http://www.openwall.com/lists/oss-security/2021/08/27/3
• https://www.fetchmail.info/security.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3XJ6XLEJCEZCAM5LGGD6XBCC522QLG4/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZYCYLL73NP7ALJWSDICIVSA47ZIXWSSA/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXMKSEHAQSEDCWZMAOJEGX3P3JW6QY6H/

• MitM attack in Fetchmail
• Red Hat Enterprise Linux 8 update for fetchmail
• SUSE update for fetchmail
• SUSE update for fetchmail
• SUSE update for fetchmail
• Gentoo update for Fetchmail
• openEuler update for fetchmail
• Fedora 35 update for fetchmail
• Fedora 34 update for fetchmail
• Fedora 33 update for fetchmail
• Anolis OS update for fetchmail