PT-2022-10520 · Mbsync+1 · Mbsync+1

Oswald Buddenhagen · Published 2022-02-18 · Updated 2024-11-25 · CVE-2021-3657

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mbsync versions prior to 1.4.4

Description A flaw was found due to inadequate handling of extremely large (>=2GiB) IMAP literals. Malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution.

Recommendations For versions prior to 1.4.4, update to version 1.4.4 or later to resolve the issue. As a temporary workaround, consider restricting access to IMAP servers to minimize the risk of exploitation. Avoid using mbsync with untrusted or potentially compromised IMAP servers until the issue is resolved.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2024-15885

ALT-PU-2024-16028

CVE-2021-3657

DLA-3066-1

OPENSUSE-SU-2024:11779-1

Affected Products

Alt Linux

Mbsync

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2021-3657 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11779-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3657 · Security Note
• https://security.gentoo.org/glsa/202208-15 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3066-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3657 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3657 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3657 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3657 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3657 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2028932 · Note
• https://openwall.com/lists/oss-security/2021/12/03/1 · Note
• https://lists.debian.org/debian-lts-announce/2022/07/msg00001.html · Note
• https://suse.com/security/cve/CVE-2021-44143 · Note
• https://t.me/cvenotify/34545 · Telegram Post