Every CVE Search/ Get API key

CVE-2021-39272

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such...

5.9 MediumFix available

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.92%Up 0.1 points since Aug 30, 2021
90%50%10%1%

What each source reports

NVD Score used 5.9

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.

Record
CVE-2021-39272
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-319
Updated
2026-11-02
CVE List No score

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.

Record
CVE-2021-39272
Updated
2026-11-02
EUVDEUVD-2021-25634 No score

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.

Record
EUVD-2021-25634
Updated
2026-11-03
GitHub AdvisoriesGHSA-x8j8-pwr7-frjw 5.9

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such...

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.

Record
GHSA-x8j8-pwr7-frjw
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-319, CWE-326
Updated
2026-11-02
OSVALPINE-CVE-2021-39272 5.9

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.

Record
ALPINE-CVE-2021-39272
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
OSVAZL-7227 5.9

CVE-2021-39272 affecting package fetchmail for versions less than 6.4.22-1

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.

Record
AZL-7227
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 16 moreShow less
OSV 5.9

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.

Record
CVE-2021-39272
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
OSVDEBIAN-CVE-2021-39272 5.9

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.

Record
DEBIAN-CVE-2021-39272
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2021-1360 5.9

fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client. Install fetchmail if you need to retrieve mail over SLIP or PPP connections.

Security Fix(es):

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.(CVE-2021-39272)

Record
OESA-2021-1360
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2022:1964 7.5

Red Hat Security Advisory: fetchmail security update

Record
RHSA-2022:1964
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2022:1964 7.5

Moderate: fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.

Security Fix(es):

  • fetchmail: DoS or information disclosure when logging long messages (CVE-2021-36386)

  • fetchmail: STARTTLS session encryption bypassing (CVE-2021-39272)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Record
RLSA-2022:1964
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-39272 5.9

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.

Record
UBUNTU-CVE-2021-39272
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2022:1964 No score

Moderate: fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.

Security Fix(es):

  • fetchmail: DoS or information disclosure when logging long messages (CVE-2021-36386)

  • fetchmail: STARTTLS session encryption bypassing (CVE-2021-39272)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:1964
Updated
2026-11-02
OSVMGASA-2021-0548 No score

Updated fetchmail packages fix security vulnerability

Update to fetchmail 6.4.24 fixes STARTTLS session encryption bypassing. (CVE-2021-39272)

Record
MGASA-2021-0548
Updated
2026-11-02
OSVopenSUSE-SU-2021:1416-1 No score

Security update for fetchmail

This update for fetchmail fixes the following issues:

  • CVE-2021-39272: Fix failure to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH. (bsc#1190069)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:1416-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:1591-1 No score

Security update for fetchmail

This update for fetchmail fixes the following issues:

  • CVE-2021-36386: Fixed DoS or information disclosure in some configurations (bsc#1188875).

  • CVE-2021-39272: Fixed STARTTLS session encryption bypassing (fetchmail-SA-2021-02) (bsc#1190069).

  • Update to 6.4.22 (bsc#1152964, jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059)

  • Remove all python2 dependencies (bsc#1190896).

  • De-hardcode /usr/lib path for launch executable (bsc#1174075).

  • Added hardening to systemd service(s) (bsc#1181400).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:1591-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:3493-1 No score

Security update for fetchmail

This update for fetchmail fixes the following issues:

  • CVE-2021-39272: Fix failure to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH. (bsc#1190069)
Record
openSUSE-SU-2021:3493-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:4018-1 No score

Security update for fetchmail

This update for fetchmail fixes the following issues:

  • CVE-2021-36386: Fixed DoS or information disclosure in some configurations (bsc#1188875).

  • CVE-2021-39272: Fixed STARTTLS session encryption bypassing (fetchmail-SA-2021-02) (bsc#1190069).

  • Update to 6.4.22 (bsc#1152964, jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059)

  • Remove all python2 dependencies (bsc#1190896).

  • De-hardcode /usr/lib path for launch executable (bsc#1174075).

  • Added hardening to systemd service(s) (bsc#1181400).

Record
openSUSE-SU-2021:4018-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11573-1 No score

fetchmail-6.4.22-1.1 on GA media

These are all security issues fixed in the fetchmail-6.4.22-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11573-1
Updated
2026-11-02
OSVSUSE-SU-2021:3492-1 No score

Security update for fetchmail

This update for fetchmail fixes the following issues:

  • CVE-2021-39272: Fix failure to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH. (bsc#1190069)
Record
SUSE-SU-2021:3492-1
Updated
2026-11-02
OSVSUSE-SU-2021:3493-1 No score

Security update for fetchmail

This update for fetchmail fixes the following issues:

  • CVE-2021-39272: Fix failure to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH. (bsc#1190069)
Record
SUSE-SU-2021:3493-1
Updated
2026-11-02
OSVSUSE-SU-2021:4018-1 No score

Security update for fetchmail

This update for fetchmail fixes the following issues:

  • CVE-2021-36386: Fixed DoS or information disclosure in some configurations (bsc#1188875).

  • CVE-2021-39272: Fixed STARTTLS session encryption bypassing (fetchmail-SA-2021-02) (bsc#1190069).

  • Update to 6.4.22 (bsc#1152964, jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059)

  • Remove all python2 dependencies (bsc#1190896).

  • De-hardcode /usr/lib path for launch executable (bsc#1174075).

  • Added hardening to systemd service(s) (bsc#1181400).

Record
SUSE-SU-2021:4018-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
fetchmail
Alpine:v3.14
 before 6.4.22-r0
6.4.22-r0
fetchmail
Alpine:v3.15
 before 6.4.22-r0
6.4.22-r0
fetchmail
Alpine:v3.16
 before 6.4.22-r0
6.4.22-r0
fetchmail
Alpine:v3.17
 before 6.4.22-r0
6.4.22-r0
fetchmail
Alpine:v3.18
 before 6.4.22-r0
6.4.22-r0
fetchmail
Alpine:v3.19
 before 6.4.22-r0
6.4.22-r0
fetchmail
Alpine:v3.20
 before 6.4.22-r0
6.4.22-r0
fetchmail
Alpine:v3.21
 before 6.4.22-r0
6.4.22-r0
fetchmail
Alpine:v3.22
 before 6.4.22-r0
6.4.22-r0
fetchmail
Alpine:v3.23
 before 6.4.22-r0
6.4.22-r0
Show 41 moreShow less
Affected packages
PackageAffectedFixed
fetchmail
Alpine:v3.24
 before 6.4.22-r0
6.4.22-r0
fetchmail
AlmaLinux:8
From an advisory covering 2 CVEs
 before 6.4.24-1.el8
6.4.24-1.el8
fetchmail
Azure Linux:2
 before 6.4.22-1
6.4.22-1
fetchmail
Debian:12
 before 6.4.22-1
6.4.22-1
fetchmail
Debian:13
 before 6.4.22-1
6.4.22-1
fetchmail
Debian:14
 before 6.4.22-1
6.4.22-1
fetchmail
Mageia:8
 before 6.4.24-1.mga8
6.4.24-1.mga8
fetchmail
openEuler:20.03-LTS-SP1
 before 6.4.22-1.oe1
6.4.22-1.oe1
fetchmail
openEuler:20.03-LTS-SP2
 before 6.4.22-1.oe1
6.4.22-1.oe1
fetchmail
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:6.4.24-1.el8
0:6.4.24-1.el8
fetchmail-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:6.4.24-1.el8
0:6.4.24-1.el8
fetchmail-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:6.4.24-1.el8
0:6.4.24-1.el8
fetchmail
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:6.4.24-1.el8
0:6.4.24-1.el8
fetchmail
SUSE:Linux Enterprise Server 12 SP5
 before 6.3.26-13.15.1
6.3.26-13.15.1
fetchmail
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 6.3.26-13.15.1
6.3.26-13.15.1
fetchmail
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 6.3.26-20.17.1
6.3.26-20.17.1
fetchmail
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 6.3.26-20.17.1
6.3.26-20.17.1
fetchmail
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
 before 6.3.26-20.17.1
6.3.26-20.17.1
fetchmail
SUSE:Linux Enterprise Module for Desktop Applications 15 SP3
 before 6.3.26-20.17.1
6.3.26-20.17.1
fetchmail
SUSE:Linux Enterprise Module for Basesystem 15 SP2
From an advisory covering 2 CVEs
 before 6.4.22-20.20.1
6.4.22-20.20.1
fetchmail
SUSE:Linux Enterprise Module for Basesystem 15 SP3
From an advisory covering 2 CVEs
 before 6.4.22-20.20.1
6.4.22-20.20.1
fetchmail
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
From an advisory covering 2 CVEs
 before 6.4.22-20.20.1
6.4.22-20.20.1
fetchmail
SUSE:Linux Enterprise Module for Desktop Applications 15 SP3
From an advisory covering 2 CVEs
 before 6.4.22-20.20.1
6.4.22-20.20.1
fetchmail
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 2 CVEs
 before 6.4.22-20.20.1
6.4.22-20.20.1
fetchmail
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 2 CVEs
 before 6.4.22-20.20.1
6.4.22-20.20.1
fetchmail
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 2 CVEs
 before 6.4.22-20.20.1
6.4.22-20.20.1
fetchmail
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 2 CVEs
 before 6.4.22-20.20.1
6.4.22-20.20.1
fetchmail
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 2 CVEs
 before 6.4.22-20.20.1
6.4.22-20.20.1
fetchmail
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 2 CVEs
 before 6.4.22-20.20.1
6.4.22-20.20.1
fetchmail
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 2 CVEs
 before 6.4.22-20.20.1
6.4.22-20.20.1
fetchmail
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 2 CVEs
 before 6.4.22-20.20.1
6.4.22-20.20.1
fetchmail
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 2 CVEs
 before 6.4.22-20.20.1
6.4.22-20.20.1
fetchmail
SUSE:Enterprise Storage 6
From an advisory covering 2 CVEs
 before 6.4.22-20.20.1
6.4.22-20.20.1
fetchmail
Ubuntu:16.04:LTS
 All versions, plus listed versions
6.3.26-16.3.26-2
 None known
fetchmail
Ubuntu:18.04:LTS
 All versions, plus listed versions
6.3.26-36.3.26-3build16.3.26-3ubuntu0.1~18.04.1
 None known
fetchmail
Ubuntu:20.04:LTS
 All versions, plus listed versions
6.4.0~rc4-1ubuntu16.4.1-1ubuntu16.4.2-2
 None known
fetchmail
openSUSE:Leap 15.2
 before 6.3.26-lp152.6.9.1
6.3.26-lp152.6.9.1
fetchmail
openSUSE:Leap 15.2
From an advisory covering 2 CVEs
 before 6.4.22-lp152.6.12.1
6.4.22-lp152.6.12.1
fetchmail
openSUSE:Leap 15.3
 before 6.3.26-20.17.1
6.3.26-20.17.1
fetchmail
openSUSE:Leap 15.3
From an advisory covering 2 CVEs
 before 6.4.22-20.20.1
6.4.22-20.20.1
fetchmail
openSUSE:Tumbleweed
 before 6.4.22-1.1
6.4.22-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD, OSV
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-39272 is a medium vulnerability (CVSS 5.9) in Fetchmail, published August 30, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.92%, the 60th percentile. Fixed in fetchmail 6.4.22-r0.

References

Show 45 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open