Vulnerability · Published Feb 16, 2022 · Assigned by redhat
CVE-2021-3578
High 7.8
In plain English
A high-severity security flaw in isync. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)1.0%top 35.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated structure by issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on the client.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | isync | 1.4.2-r0 | ALPINE-CVE-2021-3578 |
| Alpine:v3.21 | isync | 1.4.2-r0 | ALPINE-CVE-2021-3578 |
| Alpine:v3.22 | isync | 1.4.2-r0 | ALPINE-CVE-2021-3578 |
| Alpine:v3.23 | isync | 1.4.2-r0 | ALPINE-CVE-2021-3578 |
| Alpine:v3.24 | isync | 1.4.2-r0 | ALPINE-CVE-2021-3578 |
| Debian:12 | isync | 1.3.0-2.2 | DEBIAN-CVE-2021-3578 |
| Debian:13 | isync | 1.3.0-2.2 | DEBIAN-CVE-2021-3578 |
| Debian:14 | isync | 1.3.0-2.2 | DEBIAN-CVE-2021-3578 |
| Ubuntu:22.04:LTS | isync | no fix listed | UBUNTU-CVE-2021-3578 |
| Ubuntu:24.04:LTS | isync | no fix listed | UBUNTU-CVE-2021-3578 |
| Ubuntu:25.10 | isync | no fix listed | UBUNTU-CVE-2021-3578 |
| Ubuntu:26.04:LTS | isync | no fix listed | UBUNTU-CVE-2021-3578 |
| Ubuntu:26.10 | isync | no fix listed | UBUNTU-CVE-2021-3578 |
Affected products (as reported)
Weakness: CWE-704
References
- [oss-security] 20210607 CVE-2021-3578: possible remote code execution in isync/mbsync mailing-list, x_refsource_MLIST
- FEDORA-2021-f236f9f01a vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-754af4d52b vendor-advisory, x_refsource_FEDORA
- https://bugzilla.redhat.com/show_bug.cgi?id=1961710 x_refsource_MISC
- https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/ x_refsource_MISC
- https://bugzilla.redhat.com/show_bug.cgi?id=1967397 x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2021/06/07/1 x_refsource_MISC
- [debian-lts-announce] 20220701 [SECURITY] [DLA 3066-1] isync security update mailing-list, x_refsource_MLIST
- GLSA-202208-15 vendor-advisory, x_refsource_GENTOO