Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the fetchmail-6.4.24-1.el9 build changelog.

  - report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf     va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified     other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic     platform results in an impact beyond an inconvenience to the client user. (CVE-2021-36386)

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:1964 advisory.

  - report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf     va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified     other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic     platform results in an impact beyond an inconvenience to the client user. (CVE-2021-36386)

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202209-14 (Fetchmail: Multiple Vulnerabilities)

  - report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf     va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified     other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic     platform results in an impact beyond an inconvenience to the client user. (CVE-2021-36386)

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-1964 advisory.

  - report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf     va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified     other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic     platform results in an impact beyond an inconvenience to the client user. (CVE-2021-36386)

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2022:1964 advisory.

  - report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf     va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified     other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic     platform results in an impact beyond an inconvenience to the client user. (CVE-2021-36386)

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1964 advisory.

  - fetchmail: DoS or information disclosure when logging long messages (CVE-2021-36386)

  - fetchmail: STARTTLS session encryption bypassing (CVE-2021-39272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2022:1964 advisory.

  - fetchmail: DoS or information disclosure when logging long messages (CVE-2021-36386)

  - fetchmail: STARTTLS session encryption bypassing (CVE-2021-39272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1591-1 advisory.

  - report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf     va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified     other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic     platform results in an impact beyond an inconvenience to the client user. (CVE-2021-36386)

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:4018-1 advisory.

  - report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf     va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified     other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic     platform results in an impact beyond an inconvenience to the client user. (CVE-2021-36386)

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:4018-1 advisory.

  - report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf     va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified     other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic     platform results in an impact beyond an inconvenience to the client user. (CVE-2021-36386)

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1416-1 advisory.

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3492-1 advisory.

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3493-1 advisory.

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:3493-1 advisory.

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Problem :

In certain circumstances, fetchmail 6.4.21 and older would not encrypt the session using STARTTLS/STLS, and might not have cleared session state across the TLS negotiation.

ID	Name	Product	Family	Severity
191318	CentOS 9 : fetchmail-6.4.24-1.el9	Nessus	CentOS Local Security Checks	medium
184882	Rocky Linux 8 : fetchmail (RLSA-2022:1964)	Nessus	Rocky Linux Local Security Checks	medium
165440	GLSA-202209-14 : Fetchmail: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium
161312	Oracle Linux 8 : fetchmail (ELSA-2022-1964)	Nessus	Oracle Linux Local Security Checks	medium
161123	AlmaLinux 8 : fetchmail (ALSA-2022:1964)	Nessus	Alma Linux Local Security Checks	medium
161006	RHEL 8 : fetchmail (RHSA-2022:1964)	Nessus	Red Hat Local Security Checks	medium
160955	CentOS 8 : fetchmail (CESA-2022:1964)	Nessus	CentOS Local Security Checks	medium
156179	openSUSE 15 Security Update : fetchmail (openSUSE-SU-2021:1591-1)	Nessus	SuSE Local Security Checks	medium
156154	openSUSE 15 Security Update : fetchmail (openSUSE-SU-2021:4018-1)	Nessus	SuSE Local Security Checks	medium
156090	SUSE SLED15 / SLES15 Security Update : fetchmail (SUSE-SU-2021:4018-1)	Nessus	SuSE Local Security Checks	medium
154763	openSUSE 15 Security Update : fetchmail (openSUSE-SU-2021:1416-1)	Nessus	SuSE Local Security Checks	medium
154317	SUSE SLES12 Security Update : fetchmail (SUSE-SU-2021:3492-1)	Nessus	SuSE Local Security Checks	medium
154300	SUSE SLED15 / SLES15 Security Update : fetchmail (SUSE-SU-2021:3493-1)	Nessus	SuSE Local Security Checks	medium
154280	openSUSE 15 Security Update : fetchmail (openSUSE-SU-2021:3493-1)	Nessus	SuSE Local Security Checks	medium
152901	FreeBSD : fetchmail -- STARTTLS bypass vulnerabilities (1d6410e8-06c1-11ec-a35d-03ca114d16d6)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2021-39272

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium