CVE-2021-39272

Publication date 30 August 2021

Last updated 26 August 2025

Ubuntu priority

Cvss 3 Severity Score

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.

Show unmaintained releases

Package	Ubuntu Release	Status
fetchmail	26.04 LTS resolute	Not affected
	25.10 questing	Not affected
	25.04 plucky	Not affected
	24.10 oracular	Not affected
	24.04 LTS noble	Not affected
	23.10 mantic	Not affected
	23.04 lunar	Not affected
	22.10 kinetic	Ignored end of life, was needed
	22.04 LTS jammy	Not affected
	21.10 impish	Ignored end of life
	21.04 hirsute	Ignored end of life
	20.04 LTS focal	Vulnerable
	18.04 LTS bionic	Vulnerable
	16.04 LTS xenial	Needs evaluation
	14.04 LTS trusty	Not in release

when backporting, upstream is asking to make sure we update documentation covering the fixes as well

only an issue with IMAP PREAUTH sessions and STARTTLS. It is recommended to switch to implicit TLS

CVSS version: CVSS v3.0

Base score 5.9 · Medium

Base metrics

Scores

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N