UBUNTU-CVE-2025-61962: Medium severity ubuntu/fetchmail vulnerability
In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/fetchmailto a version that resolves this vulnerability.Fixed in 6.4.27-1ubuntu0.1 - Upgrade
Upgrade
ubuntu/fetchmailto a version that resolves this vulnerability.Fixed in 6.4.38-1ubuntu4.1 - Upgrade
Upgrade
ubuntu/fetchmailto a version that resolves this vulnerability.Fixed in 6.5.4-0ubuntu2
Event History
Frequently Asked Questions
What would an attacker need to exploit this issue?
An attacker would need to cause fetchmail's SMTP client to receive a 334 status code in a malformed authentication context. The issue is remotely reachable and does not require privileges or user interaction, but exploitation has high attack complexity.
What is the likely impact of successful exploitation?
Successful exploitation can crash the fetchmail SMTP client, causing a denial of service. The provided severity vector indicates no confidentiality or integrity impact.
Which fetchmail versions are affected?
Fetchmail versions before 6.5.6 are affected. Upgrading to 6.5.6 or later addresses the vulnerable behavior.