CVE-2021-36386

Vulnerability

The vulnerability resides in the report_vbuild function in report.c of Fetchmail. In all supported versions up to and including 6.4.19, the call to vsnprintf sometimes omits initialization of the va_list argument, leading to undefined behavior. This can be triggered when the mail server sends an error response longer than approximately 2 kB, causing Fetchmail to read from unintended memory locations. Affected versions are those up to 6.4.19, and also 6.4.20 (which fixed the original bug but introduced a regression in buffered output that was corrected in 6.4.21). [3] The issue was originally reported for versions up to 6.3.8 and from 6.3.17 through 6.4.19, with 6.3.9–6.3.16 being unaffected. [3]

Exploitation

An attacker controlling a mail server that Fetchmail connects to can send specially crafted long protocol error messages. No authentication or user interaction from the Fetchmail client side is required beyond normal mail retrieval operations. When Fetchmail attempts to log the error message, the uninitialized va_list causes the program to read arbitrary memory, which may lead to a crash (denial of service) or exposure of sensitive data. The issue manifests only on some platforms or configurations. [2][3]

Impact

Successful exploitation can result in Fetchmail crashing (denial of service), stalling inbound mail delivery, or in some cases, leaking potentially sensitive memory contents via logs. The impact is considered low because it requires a malicious mail server and the effect is often limited to a client-side crash or garbled logs. [3] The CVE description notes it is unclear whether real-world platforms see impact beyond client inconvenience. [desc]

Mitigation

Fetchmail 6.4.20 was released on 2021-07-28 to fix the va_list initialization issue, but it introduced a regression that caused message truncation when buffered output (e.g., --logfile) was used. A complete fix is available in Fetchmail 6.4.21, released on 2021-08-09, which includes both the security fix and the regression correction. Affected users should upgrade to version 6.4.21 or apply patches from Git commits c546c829 and d3db2da1. [1][3] Versions 6.3.x and older are no longer supported. [4]