{"id":"CVE-2021-38370","aliases":["ALPINE-CVE-2021-38370","DEBIAN-CVE-2021-38370","EUVD-2021-24823","GHSA-2c2h-qvww-cw95","UBUNTU-CVE-2021-38370","USN-7360-1","openSUSE-SU-2024:12314-1"],"status":"published","title":"In Alpine through 2.24, untagged responses from an IMAP server are accepted before STARTTLS.","description":"In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01558,"percentile":0.75534,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2021-08-10T00:00:00Z","modified":"2026-11-03T06:31:44Z","fixes":[{"ecosystem":"Alpine:v3.15","package":"alpine","fixed_in":["2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"alpine","fixed_in":["2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"alpine","fixed_in":["2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"alpine","fixed_in":["2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"alpine","fixed_in":["2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"alpine","fixed_in":["2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"alpine","fixed_in":["2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"alpine","fixed_in":["2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"alpine","fixed_in":["2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"alpine","fixed_in":["2.25-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"alpine","fixed_in":["2.25+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"alpine","fixed_in":["2.25+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"alpine","fixed_in":["2.25+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"alpine","fixed_in":["2.20+dfsg1-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"alpine","fixed_in":["2.21+dfsg1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"alpine","fixed_in":["2.22+dfsg1-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20+dfsg1-2ubuntu0.1~esm1"}]}],"versions":["2.20+dfsg1-1","2.20+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["2.20+dfsg1-7","2.21+dfsg1-1","2.21+dfsg1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["2.21+dfsg1-1.1build1","2.22+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20+dfsg1-2ubuntu0.1~esm1"}]}],"versions":["2.20+dfsg1-1","2.20+dfsg1-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["2.20+dfsg1-7","2.21+dfsg1-1","2.21+dfsg1-1build1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["2.21+dfsg1-1.1build1","2.22+dfsg1-1"],"bundled":3}],"products":[{"vendor":"alpine_project","product":"alpine"}],"references":[{"url":"https://nostarttls.secvuln.info","tags":["x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://alpine.x10host.com","tags":["x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://bugs.gentoo.org/807613#c4","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202301-07","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38370"},{"url":"https://github.com/advisories/GHSA-2c2h-qvww-cw95"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-38370","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-38370","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-38370","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38370","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7360-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-14929","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-46853","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38370","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-38370","description":"In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.","status":"published","published":"2021-08-10T00:00:00Z","modified":"2024-08-04T01:37:16.6Z","updated_at":"2026-11-02T14:33:07.349244Z"}],"euvd":[{"id":"EUVD-2021-24823","description":"In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.","status":"published","published":"2021-08-10T00:00:00Z","modified":"2024-08-04T01:37:16Z","updated_at":"2026-11-03T03:24:25.244479Z"}],"ghsa":[{"id":"GHSA-2c2h-qvww-cw95","title":"In Alpine through 2.24, untagged responses from an IMAP server are accepted before STARTTLS.","description":"In Alpine through 2.24, untagged responses from an IMAP server are accepted before STARTTLS.","status":"published","published":"2022-05-24T19:10:34Z","modified":"2023-01-27T05:04:19Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:42:26.227554Z"}],"nvd":[{"id":"CVE-2021-38370","description":"In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.","status":"published","published":"2021-08-10T15:15:08.27Z","modified":"2026-06-17T04:01:57.92Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:06:56.943671Z"}],"osv":[{"id":"ALPINE-CVE-2021-38370","description":"In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.","status":"published","published":"2021-08-10T15:15:08.27Z","modified":"2026-11-03T06:31:44.710246369Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2021-38370","description":"In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.","status":"published","published":"2021-08-10T15:15:08.27Z","modified":"2026-03-15T21:59:43.272753Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"DEBIAN-CVE-2021-38370","description":"In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.","status":"published","published":"2021-08-10T15:15:08.27Z","modified":"2026-10-23T18:03:31.393434684Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"UBUNTU-CVE-2021-38370","description":"In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.","status":"published","published":"2021-08-10T15:15:00Z","modified":"2026-02-04T04:36:20.587105Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"openSUSE-SU-2024:12314-1","title":"alpine-2.26-27.1 on GA media","description":"These are all security issues fixed in the alpine-2.26-27.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:52:11.585871Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"USN-7360-1","title":"alpine vulnerabilities","description":"It was discovered that Alpine did not use a secure connection under\ncertain circumstances. A remote attacker could possibly use this issue to\nleak sensitive information. (CVE-2020-14929)\n\nIt was discovered that Alpine could allow untagged responses from an\nIMAP server before upgrading to a TLS connection. A remote attacker could\npossibly use this issue to leak sensitive information. (CVE-2021-38370)\n\nIt was discovered that Alpine could crash when receiving certain SMTP\ncommands. A remote attacker could possibly use this issue to cause a denial\nof service. (CVE-2021-46853)\n","status":"published","published":"2025-03-20T00:37:09Z","modified":"2026-06-25T13:32:19.393957414Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}