Published: 23/02/2021 Updated: 07/11/2023

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.4 | Impact Score: 5.2 | Exploitability Score: 2.2

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N

A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the opposite end of the synchronization channel. The highest threat from this vulnerability is to data confidentiality and integrity.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mbsync project mbsync
debian debian linux 9.0
fedoraproject fedora 32
fedoraproject fedora 33
fedoraproject extra packages for enterprise linux 8.0

Debian Bug report logs - #983351 isync: CVE-2021-20247: reject funny mailbox names from IMAP LIST/LSUB Package: src:isync; Maintainer for src:isync is Nicolas Boullis <nboullis@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 22 Feb 2021 19:45:01 UTC Severity: important Tags: patch, pendi ...

isync/mbsync didn't validate the mailbox names returned by IMAP LIST/LSUB, which would allow a malicious/compromised server to use specially crafted mailbox names containing '' path components to access data outside the designated mailbox on the opposite end of the synchronization channel This is fixed in mbsync versions 135 and 141 ...

CWE-22 https://bugzilla.redhat.com/show_bug.cgi?id=1928963 https://www.openwall.com/lists/oss-security/2021/02/22/1 https://lists.debian.org/debian-lts-announce/2022/07/msg00001.html https://security.gentoo.org/glsa/202208-15 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXQLCK35QGRCRENRTGKJO4VVZGUXUJJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVDEBZQJMWDW5JFK4NTHH6DAFNAZTESW/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=983351 https://nvd.nist.gov https://security.archlinux.org/CVE-2021-20247

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2021-20247

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect