Vulnerability CVE-2021-26911
Published: 2021-02-17

Description:
core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode.

Type:

CWE-295

 (Certificate Issues)

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.8/10
4.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
None
Affected software
Libmailcore -> Mailcore2 
Canarymail -> Canary mail 

 References:
http://www.openwall.com/lists/oss-security/2021/02/17/3
https://apps.apple.com/us/app/canary-mail/id1236045954
https://census-labs.com/news/2021/02/17/canary-mail-app-missing-certificate-validation-check-on-imap-starttls/
https://census-labs.com/news/category/advisories/
https://github.com/canarymail/mailcore2/commit/45acb4efbcaa57a20ac5127dc976538671fce018
https://www.openwall.com/lists/oss-security/2021/02/17/3
Copyright 2024, cxsecurity.com

 

Back to Top