NVD Vulnerability Detail

CVE-2021-20247

Summary	A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the opposite end of the synchronization channel. The highest threat from this vulnerability is to data confidentiality and integrity.
Publication Date	Feb. 24, 2021, 4:15 a.m.
Registration Date	Feb. 24, 2021, 10:01 a.m.
Last Update	Nov. 21, 2024, 2:46 p.m.

Affected software configurations

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:9.0:::::::*
cpe:2.3:o:fedoraproject:fedora:32:::::::*
cpe:2.3:o:fedoraproject:fedora:33:::::::*
cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:::::::*

Related information, measures and tools

No	URL	タグ
1	https://bugzilla.redhat.com/show_bug.cgi?id=1928963	Issue Tracking Third Party Advisory
2	https://bugzilla.redhat.com/show_bug.cgi?id=1928963	Issue Tracking Third Party Advisory
3	https://lists.debian.org/debian-lts-announce/2022/07/msg00001.html	Mailing List Third Party Advisory
4	https://lists.debian.org/debian-lts-announce/2022/07/msg00001.html	Mailing List Third Party Advisory
5	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXQLCK35QGRCRENRTGKJO4VVZGUXUJJ/
6	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXQLCK35QGRCRENRTGKJO4VVZGUXUJJ/
7	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVDEBZQJMWDW5JFK4NTHH6DAFNAZTESW/
8	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVDEBZQJMWDW5JFK4NTHH6DAFNAZTESW/
9	https://security.gentoo.org/glsa/202208-15	Third Party Advisory
10	https://security.gentoo.org/glsa/202208-15	Third Party Advisory
11	https://www.openwall.com/lists/oss-security/2021/02/22/1	Exploit Mailing List Third Party Advisory
12	https://www.openwall.com/lists/oss-security/2021/02/22/1	Exploit Mailing List Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html

JVN Vulnerability Information

mbsync におけるパストラバーサルの脆弱性

Title	mbsync におけるパストラバーサルの脆弱性
Summary	mbsync には、パストラバーサルの脆弱性、および入力確認に関する脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 15, 2021, midnight
Registration Date	Nov. 12, 2021, 2:23 p.m.
Last Update	Nov. 12, 2021, 2:23 p.m.

Affected System

mbsync

mbsync 1.3.5 未満

mbsync 1.4.1 未満

Fedora Project

Extra Packages For Enterprise Linux

Fedora

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-20247	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20247
National Vulnerability Database (NVD)
2	CVE-2021-20247	https://nvd.nist.gov/vuln/detail/CVE-2021-20247

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html
2	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

No	Name	URL
Fedora Update Notification
1	FEDORA-2021-954ebabcf7	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CAXQLCK35QGRCRENRTGKJO4VVZGUXUJJ/
2	FEDORA-2021-ef8c2acfce	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GVDEBZQJMWDW5JFK4NTHH6DAFNAZTESW/
SourceForge
3	mbsync	https://isync.sourceforge.io/mbsync.html

その他

No	Name	URL
関連文書
1	Bug 1928963 (CVE-2021-20247) - CVE-2021-20247 isync/mbsync: mailbox names returned by IMAP LIST/LSUB not validated	https://bugzilla.redhat.com/show_bug.cgi?id=1928963

Change Log

No	Changed Details	Date of change
1	[2021年11月12日] 掲載	Nov. 12, 2021, 2:23 p.m.