UBUNTU-CVE-2021-36386: High severity ubuntu/fetchmail vulnerability
reportvbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf valist argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to control or operate a mail server that Fetchmail contacts and cause it to return long error messages. No authentication or user interaction is indicated by the supplied severity vector.
What impact is confirmed for affected Fetchmail clients?
The reported impact is a denial of service affecting the Fetchmail client. Other impact is described as unspecified, and the advisory notes that on realistic platforms the result may be no more than an inconvenience to the client user.
Which Fetchmail versions are affected?
Fetchmail versions before 6.4.20 are affected according to the report. The provided data does not identify an Ubuntu package version containing the fix.