Bug 29420 - fetchmail new security issue CVE-2021-39272
Summary: fetchmail new security issue CVE-2021-39272
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2021-08-27 17:36 CEST by David Walser
Modified: 2021-12-10 23:20 CET (History)
7 users (show)

See Also:
Source RPM: fetchmail-6.4.8-4.2.mga8.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2021-08-27 17:36:59 CEST
Upstream has issued an advisory today (August 27):
https://www.fetchmail.info/fetchmail-SA-2021-02.txt

The issue is fixed upstream in 6.4.22.

Mageia 8 is also affected.
David Walser 2021-08-27 17:37:20 CEST

Status comment: (none) => Fixed upstream in 6.4.22
Whiteboard: (none) => MGA8TOO
CC: (none) => mageia, tmb

Comment 1 Lewis Smith 2021-08-27 20:26:20 CEST
This SRPM has no regular maintainer, so assigning this bug globally. Two past committers already CC'd.

Assignee: bugsquad => pkg-bugs

Comment 2 David Walser 2021-09-26 18:48:25 CEST
Fedora has issued an advisory for this on September 24:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/L3XJ6XLEJCEZCAM5LGGD6XBCC522QLG4/

Severity: normal => major

Comment 3 Nicolas Lécureuil 2021-12-08 21:46:51 CET
fixed in cauldron

Version: Cauldron => 8
Whiteboard: MGA8TOO => (none)

Comment 4 Nicolas Lécureuil 2021-12-08 21:49:24 CET
updated in mga8:

src:
    - fetchmail-6.4.24-1.mga8

Assignee: pkg-bugs => qa-bugs
Status comment: Fixed upstream in 6.4.22 => (none)

Comment 5 David Walser 2021-12-08 22:20:16 CET
fetchmailconf-6.4.24-1.mga8
fetchmail-daemon-6.4.24-1.mga8
fetchmail-6.4.24-1.mga8

from fetchmail-6.4.24-1.mga8.src.rpm
Comment 6 Herman Viaene 2021-12-09 14:24:21 CET
MGA8-64 Plasma on Lenovo B50
No istallation issues.
Ref bug 29297 Comment 4
$ fetchmailconf 
Gives fetchmaillauncher.
Lets me define my hotmail account and then in fetchmail run window:
$ fetchmail
1 mail voor herman.viaene@hotmail.be op pop3.live.com (53873 bytes).
read message herman.viaene@hotmail.be@AMS-efz.ms-acdc.office.com:1 van 1 (53873 bytes) removed
Ref bug 1912 Comment 7
copied fetchmailrc from user to /etc and then
# systemctl start fetchmail
# systemctl status fetchmail
● fetchmail.service - A remote-mail retrieval utility
     Loaded: loaded (/usr/lib/systemd/system/fetchmail.service; disabled; vendor preset: disabled)
     Active: active (running) since Thu 2021-12-09 14:05:52 CET; 1s ago
   Main PID: 13087 (fetchmail)
      Tasks: 1 (limit: 9396)
     Memory: 1.6M
        CPU: 19ms
     CGroup: /system.slice/fetchmail.service
             └─13087 /usr/bin/fetchmail -d 300 --syslog -f /etc/fetchmailrc

dec 09 14:05:52 mach5.hviaene.thuis systemd[1]: Started A remote-mail retrieval utility.
dec 09 14:05:52 mach5.hviaene.thuis fetchmail[13087]: starten van fetchmail 6.4.24-service
OK for me

Whiteboard: (none) => MGA8-64-OK
CC: (none) => herman.viaene

PC LX 2021-12-09 15:08:59 CET

CC: (none) => mageia

Comment 7 PC LX 2021-12-09 15:23:27 CET
Installed and tested without issues.

I'm using fetchmail to grab emails from several accounts, using POP, and consolidate all emails in to a single account in dovecot I then use through IMAP. After the update, all is working as expected.


System: Mageia 8, x86_64, Intel CPU.


$ uname -a
Linux marte 5.15.6-desktop-2.mga8 #1 SMP Sat Dec 4 17:31:49 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
$ rpm -qa | grep fetchmail
fetchmail-6.4.24-1.mga8
Comment 8 Thomas Andrews 2021-12-09 19:28:09 CET
Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Dave Hodgins 2021-12-10 21:29:31 CET

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 9 Mageia Robot 2021-12-10 23:20:16 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0548.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.