PatchTheCVEfetchmail vulnerabilities
Recent CVEs affecting fetchmail products. 2 tracked.
fetchmail has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2021-08-30. Highest priority: CVE-2021-36386 (score 53/100).
- CVE-2021-39272 MEDIUM 5.9 UPGRADE MITIGATE Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain
- CVE-2021-36386 HIGH 7.5 UPGRADE MITIGATE report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list a
FAQ
How do I fix fetchmail vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is fetchmail being exploited right now?
None of the tracked fetchmail CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which fetchmail CVE should I patch first?
CVE-2021-36386 currently ranks highest (53/100): report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list a.