PT-2021-21858 · Unknown+3 · Claws Mail+3

Published 2021-07-12 · Updated 2023-01-24 · CVE-2021-37746

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Claws Mail versions prior to 3.18.0 Sylpheed versions prior to 3.7.1

Description: The issue is related to insufficient link checks in the textview uri security check function in textview.c before accepting a click. This could potentially lead to security issues.

Recommendations: For Claws Mail versions prior to 3.18.0, update to version 3.18.0 or later. For Sylpheed versions prior to 3.7.1, update to version 3.7.1 or later.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALT-PU-2021-2194

ALT-PU-2021-2495

ALT-PU-2021-3520

ALT-PU-2023-1122

CVE-2021-37746

MGASA-2021-0408

Affected Products

Alt Linux

Claws Mail

Debian

Sylpheed

References · 18

• https://ubuntu.com/security/CVE-2021-37746 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L2QNUIWASJLPUZZKWICGCEGYJZCQE7NH · Vendor Advisory
• https://sylpheed.sraoss.jp/sylpheed/v3.7/sylpheed-3.7.0.tar.xz · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RCJXHUSYHGVBSH2ULD7HNXLM7QNRECZ6 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-37746 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0408 · Vendor Advisory
• https://claws-mail.org/download.php?file=releases/claws-mail-3.18.0.tar.xz · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37746 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/RCJXHUSYHGVBSH2ULD7HNXLM7QNRECZ6 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-37746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37746 · Security Note
• https://advisories.mageia.org/MGASA-2021-0408.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-37746 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-37746 · Vendor Advisory
• https://git.claws-mail.org/?p=claws.git%3Ba=commit%3Bh=ac286a71ed78429e16c612161251b9ea90ccd431 · Note