PT-2021-17168 · Unknown · Canary Mail

Rayd Debbas · Published 2021-02-17 · Updated 2021-02-24 · CVE-2021-26911

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Canary Mail versions prior to 3.22

Description: The issue is related to missing SSL certificate validation for IMAP in STARTTLS mode. This affects the core/imap/MCIMAPSession.cpp file in Canary Mail.

Recommendations: For versions prior to 3.22, update to version 3.22 or later to resolve the issue. As a temporary workaround, consider disabling the use of STARTTLS mode for IMAP connections until a patch is available. Restrict access to IMAP services to minimize the risk of exploitation. Avoid using IMAP with STARTTLS mode in the affected versions until the issue is resolved.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2021-26911

Affected Products

Canary Mail

References · 9

• 🔥 https://census-labs.com/news/2021/02/17/canary-mail-app-missing-certificate-validation-check-on-imap-starttls · Exploit
• https://github.com/canarymail/mailcore2/commit/45acb4efbcaa57a20ac5127dc976538671fce018 · Patch
• https://openwall.com/lists/oss-security/2021/02/17/3 · Patch
• http://openwall.com/lists/oss-security/2021/02/17/3 · Patch
• https://osv.dev/vulnerability/CVE-2021-26911 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26911 · Security Note
• https://census-labs.com/news/category/advisories · Note
• https://t.me/cibsecurity/23783 · Telegram Post
• https://apps.apple.com/us/app/canary-mail/id1236045954 · Note