PT-2021-17168
CVE-2021-26911
·
تاريخ النشر
2021-02-17
·
تاريخ التحديث
2021-02-24
الوصف من
CVSS 3.1
7.4
عاليةالمقاييسAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions:
Canary Mail versions prior to 3.22
Description:
The issue is related to missing SSL certificate validation for IMAP in STARTTLS mode. This affects the
core/imap/MCIMAPSession.cpp file in Canary Mail.Recommendations:
For versions prior to 3.22, update to version 3.22 or later to resolve the issue. As a temporary workaround, consider disabling the use of STARTTLS mode for IMAP connections until a patch is available. Restrict access to IMAP services to minimize the risk of exploitation. Avoid using IMAP with STARTTLS mode in the affected versions until the issue is resolved.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾