{"id":"CVE-2021-39272","aliases":["ALPINE-CVE-2021-39272","ALSA-2022:1964","AZL-7227","DEBIAN-CVE-2021-39272","EUVD-2021-25634","GHSA-x8j8-pwr7-frjw","MGASA-2021-0548","OESA-2021-1360","RHSA-2022:1964","RLSA-2022:1964","SUSE-SU-2021:3492-1","SUSE-SU-2021:3493-1","SUSE-SU-2021:4018-1","UBUNTU-CVE-2021-39272","openSUSE-SU-2021:1416-1","openSUSE-SU-2021:1591-1","openSUSE-SU-2021:3493-1","openSUSE-SU-2021:4018-1","openSUSE-SU-2024:11573-1"],"status":"published","title":"Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such...","description":"Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00925,"percentile":0.60885,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-319","CWE-326"],"published":"2021-08-30T05:05:26Z","modified":"2026-11-10T02:49:19Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"fetchmail","fixed_in":["6.4.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"fetchmail","fixed_in":["6.4.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"fetchmail","fixed_in":["6.4.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"fetchmail","fixed_in":["6.4.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"fetchmail","fixed_in":["6.4.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"fetchmail","fixed_in":["6.4.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"fetchmail","fixed_in":["6.4.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"fetchmail","fixed_in":["6.4.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"fetchmail","fixed_in":["6.4.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"fetchmail","fixed_in":["6.4.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"fetchmail","fixed_in":["6.4.22-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"fetchmail","fixed_in":["6.4.22-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"fetchmail","fixed_in":["6.4.22-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fetchmail","fixed_in":["6.4.22-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fetchmail","fixed_in":["6.4.22-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"fetchmail","fixed_in":["6.4.24-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"fetchmail","fixed_in":["6.4.22-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"fetchmail","fixed_in":["6.4.22-1.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"fetchmail","fixed_in":["6.3.26-13.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"fetchmail","fixed_in":["6.3.26-13.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"fetchmail","fixed_in":["6.3.26-20.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"fetchmail","fixed_in":["6.3.26-20.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"fetchmail","fixed_in":["6.3.26-20.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"fetchmail","fixed_in":["6.3.26-20.17.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"fetchmail","fixed_in":["6.3.26-lp152.6.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"fetchmail","fixed_in":["6.3.26-20.17.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"fetchmail","fixed_in":["6.4.22-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.24-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.24-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-1.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.24-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fetchmail-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.24-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fetchmail-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.24-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.24-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-13.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-13.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.26-1","6.3.26-2","6.3.26-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.26-3","6.3.26-3build1","6.3.26-3ubuntu0.1~18.04.1","6.3.26-3ubuntu0.1~18.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.0~rc4-1ubuntu1","6.4.1-1ubuntu1","6.4.2-2","6.4.2-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-lp152.6.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-lp152.6.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-20.17.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-20.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-1.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"fetchmail","product":"fetchmail"}],"references":[{"url":"https://www.fetchmail.info/security.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nostarttls.secvuln.info/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2021/08/27/3","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XJ6XLEJCEZCAM5LGGD6XBCC522QLG4/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZYCYLL73NP7ALJWSDICIVSA47ZIXWSSA/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXMKSEHAQSEDCWZMAOJEGX3P3JW6QY6H/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202209-14","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39272","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3XJ6XLEJCEZCAM5LGGD6XBCC522QLG4/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXMKSEHAQSEDCWZMAOJEGX3P3JW6QY6H/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZYCYLL73NP7ALJWSDICIVSA47ZIXWSSA/"},{"url":"https://github.com/advisories/GHSA-x8j8-pwr7-frjw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-39272","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-1964.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-36386","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-39272","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-39272","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0548.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29420","tags":["report"]},{"url":"https://www.fetchmail.info/fetchmail-SA-2021-02.txt","tags":["web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/L3XJ6XLEJCEZCAM5LGGD6XBCC522QLG4/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1360","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1964","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1987766","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1999190","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1964.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-36386","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-36386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36386","tags":["advisory"]},{"url":"https://www.fetchmail.info/fetchmail-SA-2021-01.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-39272","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39272","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1964","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213492-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190069","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39272","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213493-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20214018-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1152964","tags":["report"]},{"url":"https://bugzilla.suse.com/1174075","tags":["report"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1188875","tags":["report"]},{"url":"https://bugzilla.suse.com/1190896","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36386","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-39272","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/08/27/3","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GKBTMGZAXDA7DYFMUAFILOUSIZ5RNGMY/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2MQSBOFKUN3D2SAYKHGH2NQW7UGR6J7P/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YSSYZRBZ642QLUIU2C7RUKT5PKPXQPKZ/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZEYREAP5E4PNL4UXB7R6OYSFSQ5VNFHB/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-39272","description":"Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.","status":"published","published":"2021-08-30T05:05:26Z","modified":"2024-08-04T02:06:41.615Z","updated_at":"2026-11-02T14:33:09.864034Z"}],"euvd":[{"id":"EUVD-2021-25634","description":"Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.","status":"published","published":"2021-08-30T05:05:26Z","modified":"2024-08-04T02:06:41Z","updated_at":"2026-11-03T03:24:23.719378Z"}],"ghsa":[{"id":"GHSA-x8j8-pwr7-frjw","title":"Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such...","description":"Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.","status":"published","published":"2022-05-24T19:12:32Z","modified":"2023-02-02T05:05:13Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-319","CWE-326"],"updated_at":"2026-11-02T14:52:03.084435Z"}],"nvd":[{"id":"CVE-2021-39272","description":"Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.","status":"published","published":"2021-08-30T06:15:06.45Z","modified":"2026-06-17T04:03:26.937Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:06:57.67549Z"}],"osv":[{"id":"ALPINE-CVE-2021-39272","description":"Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.","status":"published","published":"2021-08-30T06:15:06.45Z","modified":"2026-11-03T06:31:45.203962335Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"AZL-7227","title":"CVE-2021-39272 affecting package fetchmail for versions less than 6.4.22-1","description":"Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.","status":"published","published":"2021-08-30T06:15:06Z","modified":"2026-04-21T04:36:42.181048Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CVE-2021-39272","description":"Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.","status":"published","published":"2021-08-30T06:15:06.45Z","modified":"2026-11-03T02:30:44.696922612Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:05:53.289262Z"},{"id":"DEBIAN-CVE-2021-39272","description":"Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.","status":"published","published":"2021-08-30T06:15:06.45Z","modified":"2026-10-23T18:03:27.1795717Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"OESA-2021-1360","title":"fetchmail security update","description":"Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client. Install fetchmail if you need to retrieve mail over SLIP or PPP connections.\r\n\r\nSecurity Fix(es):\r\n\r\nFetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.(CVE-2021-39272)","status":"published","published":"2021-09-30T11:04:37Z","modified":"2026-08-18T01:16:01.305352973Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2022:1964","title":"Red Hat Security Advisory: fetchmail security update","status":"published","published":"2024-09-16T07:29:13Z","modified":"2025-11-22T12:33:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:1964","title":"Moderate: fetchmail security update","description":"Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.\n\nSecurity Fix(es):\n\n* fetchmail: DoS or information disclosure when logging long messages (CVE-2021-36386)\n\n* fetchmail: STARTTLS session encryption bypassing (CVE-2021-39272)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:41:48Z","modified":"2026-02-04T23:45:04.954618Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-39272","description":"Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.","status":"published","published":"2021-08-30T06:15:00Z","modified":"2026-11-10T02:49:19.236227744Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-10T03:16:57.350686Z"},{"id":"ALSA-2022:1964","title":"Moderate: fetchmail security update","description":"Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.\n\nSecurity Fix(es):\n\n* fetchmail: DoS or information disclosure when logging long messages (CVE-2021-36386)\n\n* fetchmail: STARTTLS session encryption bypassing (CVE-2021-39272)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:41:48Z","modified":"2026-10-29T11:01:18.302979699Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"MGASA-2021-0548","title":"Updated fetchmail packages fix security vulnerability","description":"Update to fetchmail 6.4.24 fixes STARTTLS session encryption bypassing.\n(CVE-2021-39272)\n","status":"published","published":"2021-12-10T22:19:07Z","modified":"2026-04-16T04:42:41.276890422Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1416-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- CVE-2021-39272: Fix failure to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH. (bsc#1190069)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-10-31T15:07:46Z","modified":"2026-02-04T02:15:01.038709Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:1591-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- CVE-2021-36386: Fixed DoS or information disclosure in some configurations (bsc#1188875).\n- CVE-2021-39272: Fixed STARTTLS session encryption bypassing (fetchmail-SA-2021-02) (bsc#1190069).\n\n- Update to 6.4.22 (bsc#1152964, jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059)\n- Remove all python2 dependencies (bsc#1190896).\n- De-hardcode /usr/lib path for launch executable (bsc#1174075).\n- Added hardening to systemd service(s) (bsc#1181400).\n  \nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-12-17T11:06:33Z","modified":"2026-02-04T03:51:21.656624Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3493-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- CVE-2021-39272: Fix failure to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH. (bsc#1190069)\n","status":"published","published":"2021-10-20T14:38:04Z","modified":"2025-05-07T18:13:09.769449Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:4018-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- CVE-2021-36386: Fixed DoS or information disclosure in some configurations (bsc#1188875).\n- CVE-2021-39272: Fixed STARTTLS session encryption bypassing (fetchmail-SA-2021-02) (bsc#1190069).\n\n- Update to 6.4.22 (bsc#1152964, jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059)\n- Remove all python2 dependencies (bsc#1190896).\n- De-hardcode /usr/lib path for launch executable (bsc#1174075).\n- Added hardening to systemd service(s) (bsc#1181400).\n  ","status":"published","published":"2021-12-14T07:58:47Z","modified":"2026-02-04T02:17:39.577669Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11573-1","title":"fetchmail-6.4.22-1.1 on GA media","description":"These are all security issues fixed in the fetchmail-6.4.22-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:36:27.525501Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:3492-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- CVE-2021-39272: Fix failure to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH. (bsc#1190069)\n","status":"published","published":"2021-10-20T14:37:44Z","modified":"2026-02-04T04:03:27.36322Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3493-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- CVE-2021-39272: Fix failure to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH. (bsc#1190069)\n","status":"published","published":"2021-10-20T14:38:03Z","modified":"2026-02-04T04:02:59.357531Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:4018-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- CVE-2021-36386: Fixed DoS or information disclosure in some configurations (bsc#1188875).\n- CVE-2021-39272: Fixed STARTTLS session encryption bypassing (fetchmail-SA-2021-02) (bsc#1190069).\n\n- Update to 6.4.22 (bsc#1152964, jsc#SLE-18159, jsc#SLE-17903, jsc#SLE-18059)\n- Remove all python2 dependencies (bsc#1190896).\n- De-hardcode /usr/lib path for launch executable (bsc#1174075).\n- Added hardening to systemd service(s) (bsc#1181400).\n  ","status":"published","published":"2021-12-14T07:59:15Z","modified":"2026-02-04T02:54:54.665426Z","updated_at":"2026-11-02T15:53:50.066806Z"}]}}