CVE-2021-36386

report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.

report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client. Install fetchmail if you need to retrieve mail over SLIP or PPP connections.

Security Fix(es):

report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.(CVE-2021-36386)

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.

Security Fix(es):

• fetchmail: DoS or information disclosure when logging long messages (CVE-2021-36386)

• fetchmail: STARTTLS session encryption bypassing (CVE-2021-39272)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.

Security Fix(es):

• fetchmail: DoS or information disclosure when logging long messages (CVE-2021-36386)

• fetchmail: STARTTLS session encryption bypassing (CVE-2021-39272)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Updated fetchmail packages fix security vulnerability:

report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages (CVE-2021-36386).

This update for fetchmail fixes the following issues:

• CVE-2021-36386: Fixed a missing variable initialization that can cause read from bad memory locations. (bsc#1188875)
• Change PASSWORDLEN from 64 to 256 (bsc#1188034)

This update was imported from the SUSE:SLE-15:Update update project.

This update for fetchmail fixes the following issues:

• CVE-2021-36386: Fixed DoS or information disclosure in some configurations (bsc#1188875).

• CVE-2021-39272: Fixed STARTTLS session encryption bypassing (fetchmail-SA-2021-02) (bsc#1190069).

• Update to 6.4.22 (bsc#1152964, jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059)

• Remove all python2 dependencies (bsc#1190896).

• De-hardcode /usr/lib path for launch executable (bsc#1174075).

• Added hardening to systemd service(s) (bsc#1181400).

This update was imported from the SUSE:SLE-15:Update update project.

This update for fetchmail fixes the following issues:

• CVE-2021-36386: Fixed a missing variable initialization that can cause read from bad memory locations. (bsc#1188875)
• Change PASSWORDLEN from 64 to 256 (bsc#1188034)

This update for fetchmail fixes the following issues:

• CVE-2021-36386: Fixed DoS or information disclosure in some configurations (bsc#1188875).

• CVE-2021-39272: Fixed STARTTLS session encryption bypassing (fetchmail-SA-2021-02) (bsc#1190069).

• Update to 6.4.22 (bsc#1152964, jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059)

• Remove all python2 dependencies (bsc#1190896).

• De-hardcode /usr/lib path for launch executable (bsc#1174075).

• Added hardening to systemd service(s) (bsc#1181400).

These are all security issues fixed in the fetchmail-6.4.21-2.1 package on the GA media of openSUSE Tumbleweed.

This update for fetchmail fixes the following issues:

• CVE-2021-36386: DoS or information disclosure in some configurations (bsc#1188875)
• Change PASSWORDLEN from 64 to 256 [bsc#1188034]
• Set the hostname for SNI when using TLS [bsc#1182807]
• Allow --syslog option in daemon mode. (bsc#1033081)
• Set the hostname for SNI when using TLS. (bsc#1182807)
• Change PASSWORDLEN from 64 to 256 (bsc#1188034)

This update for fetchmail fixes the following issues:

• CVE-2021-36386: Fixed a missing variable initialization that can cause read from bad memory locations. (bsc#1188875)
• Change PASSWORDLEN from 64 to 256 (bsc#1188034)

This update for fetchmail fixes the following issues:

• CVE-2021-36386: Fixed DoS or information disclosure in some configurations (bsc#1188875).

• CVE-2021-39272: Fixed STARTTLS session encryption bypassing (fetchmail-SA-2021-02) (bsc#1190069).

• Update to 6.4.22 (bsc#1152964, jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059)

• Remove all python2 dependencies (bsc#1190896).

• De-hardcode /usr/lib path for launch executable (bsc#1174075).

• Added hardening to systemd service(s) (bsc#1181400).

This update for fetchmail fixes the following issues:

• Fixed regression in patch for CVE-2021-36386 (bsc#1224188)