CVE-2021-20247

February 27, 2021

A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing ‘..’ path components to access data outside the designated mailbox on the opposite end of the synchronization channel. The highest threat from this vulnerability is to data confidentiality and integrity.

Summary:

A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing ‘..’ path components to access data outside the designated mailbox on the opposite end of the synchronization channel. The highest threat from this vulnerability is to data confidentiality and integrity.

Reference Links(if available):

  • https://bugzilla.redhat.com/show_bug.cgi?id=1928963
  • https://www.openwall.com/lists/oss-security/2021/02/22/1

  • CVSS Score (if available)

    v2: / MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N

    v3: / HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

    Links to Exploits(if available)

  • You may have missed

    image

    [RHYSIDA] – Ransomware Victim: American Addiction Centers

    November 16, 2024
    image

    [LYNX] – Ransomware Victim: Grupo_Trisan

    November 16, 2024
    brute ratel c4

    Brute Ratel C4 Detected – 52[.]193[.]97[.]60:80

    November 16, 2024
    CISA Logo

    CISA: CISA Releases One Industrial Control Systems Advisory

    November 16, 2024
    CISA Logo

    CISA: CISA Adds One Known Exploited Vulnerability to Catalog

    November 16, 2024