CVE-2021-39272 Security feature bypass in n/a
Fetchmail fails to enforce STARTTLS encryption in certain IMAP scenarios, allowing attackers to intercept email data in transit.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-39272?
CVE-2021-39272 is a medium-severity vulnerability in Fedoraproject Fedora, published on 30 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.
Weakness: CWE-319
Which versions are affected by CVE-2021-39272?
It affects 2 products.
Linux distribution packages (9)
fetchmail SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 6.3.26-20.17.1 |
fetchmail SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 6.3.26-20.17.1 |
fetchmail SUSE:Linux Enterprise Module for Desktop Applications 15 SP2 | All versions | 6.3.26-20.17.1 |
fetchmail SUSE:Linux Enterprise Module for Desktop Applications 15 SP3 | All versions | 6.3.26-20.17.1 |
fetchmail SUSE:Linux Enterprise Server 12 SP5 | All versions | 6.3.26-13.15.1 |
fetchmail SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 6.3.26-13.15.1 |
fetchmail openSUSE:Leap 15.2 | All versions | 6.3.26-lp152.6.9.1 |
fetchmail openSUSE:Leap 15.3 | All versions | 6.3.26-20.17.1 |
fetchmail openSUSE:Tumbleweed | All versions | 6.4.22-1.1 |
Products include Fedoraproject Fedora, Fetchmail Fetchmail.
How do I fix CVE-2021-39272?
Upgrade to a fixed version.
Is CVE-2021-39272 being exploited?
There is no known exploitation of CVE-2021-39272 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-7227, CLEANSTART-2024-QK25555, DEBIAN-CVE-2021-39272, GHSA-x8j8-pwr7-frjw, MGASA-2021-0548, OESA-2021-1360 and 6 more.