PT-2021-3614 · Mutt+8 · Mutt+8
Tavis Ormandy
·
Published
2021-01-17
·
Updated
2024-06-15
·
CVE-2021-3181
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Mutt versions through 2.0.4
Description
The issue is related to the incorrect handling of sequences of semicolon characters in RFC822 address fields by the rfc822.c component of the Mutt email client. This can be exploited by a remote attacker to cause a denial of service, resulting in mailbox unavailability. The attacker can send email messages with sequences of semicolon characters, leading to large memory consumption. As a result, the victim may be unable to see email messages from other persons.
Recommendations
For versions through 2.0.4, consider disabling the handling of semicolon characters in RFC822 address fields as a temporary workaround until a patch is available. Restrict access to the
rfc822.c component to minimize the risk of exploitation. Avoid processing email messages with suspicious sequences of semicolon characters in address fields until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
Resource Exhaustion
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linuxmint
Mutt
Red Hat
Rocky Linux
Suse
Ubuntu