PT-2021-3853 · Fortinet · Fortimail

Published 2021-07-02 · Updated 2023-08-08 · CVE-2021-26099

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiMail versions prior to 7.0.0

Description The issue is related to missing cryptographic steps in the Identity-Based Encryption service of FortiMail, which may allow an attacker to compromise the confidentiality of encrypted master keys by observing a few invariant properties of the ciphertext. This vulnerability is associated with the use of defective cryptographic algorithms, potentially enabling a remote attacker to bypass encryption protection mechanisms and gain unauthorized access to protected information.

Recommendations For FortiMail versions prior to 7.0.0, update to version 7.0.0 or later to resolve the issue.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

BDU:2021-04211

CVE-2021-26099

Affected Products

Fortimail

References · 5

• https://fortiguard.com/advisory/FG-IR-20-244 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26099 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26099 · Security Note
• https://bdu.fstec.ru/vul/2021-04211 · Security Note
• https://fortiguard.com/psirt/FG-IR-20-244 · Note