CVE-2021-44143
A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unc ...
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Ubuntu (medium).
Description
A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be exploited for remote code execution.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.15 | isync | 1.4.4-r0 |
| alpine 3.16 | isync | 1.4.4-r0 |
| alpine 3.17 | isync | 1.4.4-r0 |
| alpine 3.18 | isync | 1.4.4-r0 |
| alpine 3.19 | isync | 1.4.4-r0 |
| alpine 3.20 | isync | 1.4.4-r0 |
| alpine 3.21 | isync | 1.4.4-r0 |
| alpine 3.22 | isync | 1.4.4-r0 |
| alpine 3.23 | isync | 1.4.4-r0 |
| alpine 3.24 | isync | 1.4.4-r0 |
| alpine edge | isync | 1.4.4-r0 |
| debian 12 | isync | 1.4.4-1 |
Show all 22 entries from 22 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.15 | isync | 1.4.4-r0 |
| alpine 3.16 | isync | 1.4.4-r0 |
| alpine 3.17 | isync | 1.4.4-r0 |
| alpine 3.18 | isync | 1.4.4-r0 |
| alpine 3.19 | isync | 1.4.4-r0 |
| alpine 3.20 | isync | 1.4.4-r0 |
| alpine 3.21 | isync | 1.4.4-r0 |
| alpine 3.22 | isync | 1.4.4-r0 |
| alpine 3.23 | isync | 1.4.4-r0 |
| alpine 3.24 | isync | 1.4.4-r0 |
| alpine edge | isync | 1.4.4-r0 |
| debian 12 | isync | 1.4.4-1 |
| debian 13 | isync | 1.4.4-1 |
| debian 14 | isync | 1.4.4-1 |
| echo | isync | 1.4.4-1 |
| rapidfort ubuntu 20.04 | isync | no fix listed |
| rapidfort ubuntu 22.04 | isync | no fix listed |
| rapidfort ubuntu 24.04 | isync | no fix listed |
| ubuntu 22.04 | isync | no fix listed |
| ubuntu 24.04 | isync | no fix listed |
| ubuntu 26.04 | isync | no fix listed |
| ubuntu 26.10 | isync | no fix listed |
References
- http://www.openwall.com/lists/oss-security/2021/12/03/2
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999804
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYZ2GNB4ZO2T27D2XNUWMCS3THZYSJQU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LCBSY7OZ57XNC6ZYXF6WU5KBSWITZVDX/
- https://security.gentoo.org/glsa/202208-15
- https://sourceforge.net/p/isync/isync/commit_browser
- https://sourceforge.net/p/isync/isync/ref/master/tags/
- https://www.cve.org/CVERecord?id=CVE-2021-44143