Bug 29420

Summary:	fetchmail new security issue CVE-2021-39272
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	major
Priority:	Normal	CC:	andrewsfarm, davidwhodgins, herman.viaene, mageia, mageia, sysadmin-bugs, tmb
Version:	8	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA8-64-OK
Source RPM:	fetchmail-6.4.8-4.2.mga8.src.rpm	CVE:
Status comment:

Description David Walser 2021-08-27 17:36:59 CEST

Upstream has issued an advisory today (August 27):
https://www.fetchmail.info/fetchmail-SA-2021-02.txt

The issue is fixed upstream in 6.4.22.

Mageia 8 is also affected.

David Walser 2021-08-27 17:37:20 CEST

Status comment: (none) => Fixed upstream in 6.4.22
Whiteboard: (none) => MGA8TOO
CC: (none) => mageia, tmb

Comment 1 Lewis Smith 2021-08-27 20:26:20 CEST

This SRPM has no regular maintainer, so assigning this bug globally. Two past committers already CC'd.

Assignee: bugsquad => pkg-bugs

Comment 2 David Walser 2021-09-26 18:48:25 CEST

Fedora has issued an advisory for this on September 24:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/L3XJ6XLEJCEZCAM5LGGD6XBCC522QLG4/

Severity: normal => major

Comment 3 Nicolas Lécureuil 2021-12-08 21:46:51 CET

fixed in cauldron

Version: Cauldron => 8
Whiteboard: MGA8TOO => (none)

Comment 4 Nicolas Lécureuil 2021-12-08 21:49:24 CET

updated in mga8:

src:
    - fetchmail-6.4.24-1.mga8

Assignee: pkg-bugs => qa-bugs
Status comment: Fixed upstream in 6.4.22 => (none)

Comment 5 David Walser 2021-12-08 22:20:16 CET

fetchmailconf-6.4.24-1.mga8
fetchmail-daemon-6.4.24-1.mga8
fetchmail-6.4.24-1.mga8

from fetchmail-6.4.24-1.mga8.src.rpm

Comment 6 Herman Viaene 2021-12-09 14:24:21 CET

MGA8-64 Plasma on Lenovo B50
No istallation issues.
Ref bug 29297 Comment 4
$ fetchmailconf 
Gives fetchmaillauncher.
Lets me define my hotmail account and then in fetchmail run window:
$ fetchmail
1 mail voor herman.viaene@hotmail.be op pop3.live.com (53873 bytes).
read message herman.viaene@hotmail.be@AMS-efz.ms-acdc.office.com:1 van 1 (53873 bytes) removed
Ref bug 1912 Comment 7
copied fetchmailrc from user to /etc and then
# systemctl start fetchmail
# systemctl status fetchmail
● fetchmail.service - A remote-mail retrieval utility
     Loaded: loaded (/usr/lib/systemd/system/fetchmail.service; disabled; vendor preset: disabled)
     Active: active (running) since Thu 2021-12-09 14:05:52 CET; 1s ago
   Main PID: 13087 (fetchmail)
      Tasks: 1 (limit: 9396)
     Memory: 1.6M
        CPU: 19ms
     CGroup: /system.slice/fetchmail.service
             └─13087 /usr/bin/fetchmail -d 300 --syslog -f /etc/fetchmailrc

dec 09 14:05:52 mach5.hviaene.thuis systemd[1]: Started A remote-mail retrieval utility.
dec 09 14:05:52 mach5.hviaene.thuis fetchmail[13087]: starten van fetchmail 6.4.24-service
OK for me

Whiteboard: (none) => MGA8-64-OK
CC: (none) => herman.viaene

PC LX 2021-12-09 15:08:59 CET

CC: (none) => mageia

Comment 7 PC LX 2021-12-09 15:23:27 CET

Installed and tested without issues.

I'm using fetchmail to grab emails from several accounts, using POP, and consolidate all emails in to a single account in dovecot I then use through IMAP. After the update, all is working as expected.


System: Mageia 8, x86_64, Intel CPU.


$ uname -a
Linux marte 5.15.6-desktop-2.mga8 #1 SMP Sat Dec 4 17:31:49 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
$ rpm -qa | grep fetchmail
fetchmail-6.4.24-1.mga8

Comment 8 Thomas Andrews 2021-12-09 19:28:09 CET

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Dave Hodgins 2021-12-10 21:29:31 CET

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 9 Mageia Robot 2021-12-10 23:20:16 CET

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0548.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED