CVE-2021-20247

State: Published
Severity: Not scored
Published: Feb 23, 2021
Updated: Aug 3, 2024
Reserved: Dec 17, 2020

Description

A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the opposite end of the synchronization channel. The highest threat from this vulnerability is to data confidentiality and integrity.

Scores

The record has no CVSS score.

Weaknesses

CWE-20 >CWE-22

Affected Products

Product	Versions
isync/mbsyncn/a	before 1.35Affected before 1.4.1Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=1928963
https://www.openwall.com/lists/oss-security/2021/02/22/1
FEDORA-2021-954ebabcf7vendor-advisory
FEDORA-2021-ef8c2acfcevendor-advisory
[debian-lts-announce] 20220701 [SECURITY] [DLA 3066-1] isync security updatemailing-list
GLSA-202208-15vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.