CVE-2021-20247
Fixed in a distro release EPSS 2%
A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the opposite end of the synchronization channel. The highest threat from this vulnerability is to data confidentiality and integrity.
Products: mbsync_project mbsync, fedoraproject extra_packages_for_enterprise_linux, debian_linux, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | isync | 1.3.5-1 |
| Debian 12 | isync | 1.3.0-2.1 |
| Debian 13 | isync | 1.3.0-2.1 |
| Debian 14 | isync | 1.3.0-2.1 |
| Debian 9 | isync | 1.2.1-2+deb9u1 |
| SUSE Package Hub 15 SP2 | isync | 1.3.5-bp152.4.3.1 |
| Ubuntu 16.04 LTS | isync | no fix |
| Ubuntu 18.04 LTS | isync | no fix |
| Ubuntu 20.04 LTS | isync | no fix |
| Ubuntu 22.04 LTS | isync | no fix |
| Ubuntu 24.04 LTS | isync | no fix |
| Ubuntu 25.10 | isync | no fix |
| Ubuntu 26.04 LTS | isync | no fix |
| Ubuntu 26.10 | isync | no fix |
| openSUSE Leap 15.2 | isync | 1.3.5-lp152.4.3.1 |
| openSUSE Tumbleweed | isync | 1.4.3-1.2 |