fetchmail: CVE-2021-39272

Debian Bug report logs - #993163
fetchmail: CVE-2021-39272

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: fetchmail: CVE-2021-39272

Date: Sat, 28 Aug 2021 10:23:57 +0200

Source: fetchmail
Version: 6.4.21-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 6.4.16-4
Control: found -1 6.4.0~beta4-3+deb10u1
Control: found -1 6.4.0~beta4-1

Hi,

The following vulnerability was published for fetchmail.

CVE-2021-39272[0]:
| TLS bypass vulnerabilities ("NO STARTTLS")

Note I think this does not warrant a DSA. But if cherry-picking
changes for bullseye and buster, as per [1] proabably should pick as
well the documentation updates with the updated recommendations.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-39272
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39272
[1] https://www.fetchmail.info/fetchmail-SA-2021-02.txt

Regards,
Salvatore

Message #16 received at 993163@bugs.debian.org (full text, mbox, reply):

From: Matthias Andree <matthias.andree@gmx.de>

To: Salvatore Bonaccorso <carnil@debian.org>, 993163@bugs.debian.org, 993163-maintainer@bugs.debian.org

Subject: Re: Bug#993163: fetchmail: CVE-2021-39272

Date: Sat, 28 Aug 2021 11:24:02 +0200

Just a word of warning, this isn't your pick three git commits with
trivial fixes - the backport will require proper testing, too, and it
will require some of the 42 patches since fetchmail 6.4.21 that are NOT
marked SECURITY - for instance, 74771392 and 616e8c70, and translation
updates as they are now trickling in, and documentation updates that
suggest limiting TLS to TLS1.2+, so anything that looks like SSL or TLS
documentation update.

Feel free to ask simple "do I need commit c0decafe to fix this CVE"
questions on the fetchmail-devel@ list for the benefit of other
distributors backporting.

Note that there was a lot of drive-by bugfixing that also warrants
updating independent of the CVE.

Message #21 received at 993163@bugs.debian.org (full text, mbox, reply):

From: László Böszörményi (GCS) <gcs@debian.org>

To: Matthias Andree <matthias.andree@gmx.de>, 993163@bugs.debian.org

Cc: Salvatore Bonaccorso <carnil@debian.org>

Subject: Re: Bug#993163: fetchmail: CVE-2021-39272

Date: Sat, 28 Aug 2021 12:14:14 +0200

Hi Matthias,

On Sat, Aug 28, 2021 at 11:27 AM Matthias Andree <matthias.andree@gmx.de> wrote:
> Just a word of warning, this isn't your pick three git commits with
> trivial fixes - the backport will require proper testing, too, and it
> will require some of the 42 patches since fetchmail 6.4.21 that are NOT
> marked SECURITY - for instance, 74771392 and 616e8c70, and translation
> updates as they are now trickling in, and documentation updates that
> suggest limiting TLS to TLS1.2+, so anything that looks like SSL or TLS
> documentation update.
[...]
> Note that there was a lot of drive-by bugfixing that also warrants
> updating independent of the CVE.
 You are kind of a mind reader. There are several important commits to
backport and I'm not sure it is worth testing if all backported ones
are in place and properly fix all security issues. I think it's much
better to make a full package update.
Ie, put 6.4.22 to Bullseye instead of the 6.4.16 version. For the
first look, I didn't see any change that might be unintended for a
stable update.

Thanks for your follow up!
Laszlo/GCS

Send a report that this bug log contains spam.