CVE-2021-20247

Опубликовано: 23 фев. 2021

Источник: nvd

CVSS3: 7.4

CVSS2: 5.8

EPSS Низкий

Описание

A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the opposite end of the synchronization channel. The highest threat from this vulnerability is to data confidentiality and integrity.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=1928963
Issue Tracking
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/07/msg00001.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXQLCK35QGRCRENRTGKJO4VVZGUXUJJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVDEBZQJMWDW5JFK4NTHH6DAFNAZTESW/
https://security.gentoo.org/glsa/202208-15
Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/02/22/1
Exploit
Mailing List
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1928963
Issue Tracking
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/07/msg00001.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXQLCK35QGRCRENRTGKJO4VVZGUXUJJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVDEBZQJMWDW5JFK4NTHH6DAFNAZTESW/
https://security.gentoo.org/glsa/202208-15
Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/02/22/1
Exploit
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:mbsync_project:mbsync:*:*:*:*:*:*:*:*

Версия до 1.3.5 (исключая)

cpe:2.3:a:mbsync_project:mbsync:*:*:*:*:*:*:*:*

Версия от 1.4.0 (включая) до 1.4.1 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

EPSS

Процентиль: 80%

0.01449

Низкий

7.4 High

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-20

CWE-22

Связанные уязвимости

CVE-2021-20247

CVSS3: 7.4

ubuntu

почти 5 лет назад

CVE-2021-20247

CVSS3: 7.4

debian

почти 5 лет назад

A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of th ...

openSUSE-SU-2021:0516-1

suse-cvrf

почти 5 лет назад

Security update for isync

GHSA-5cp5-w68m-9w38

CVSS3: 7.4

github

больше 3 лет назад

EPSS

Процентиль: 80%

0.01449

Низкий

7.4 High

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-20

CWE-22