GNU Mailutils: unexpected processsing of escape sequences — GLSA 202310-13

A vulnerability has been discovered in Mailutils where escape sequences are processed in a context where this may lead to RCE.

Affected packages

Background

GNU Mailutils is a collection of mail-related utilities, including an IMAP4 server (imap4d) and a Mail User Agent (mail).

Description

A vulnerability has been discovered in GNU Mailutils. Please review the CVE identifier referenced below for details.

Impact

mail(1) from mailutils would process escape sequences (like ~! shellcommand) in message bodies piped/redirected in. This creates an RCE if some part of the message body is under an attacker's control.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-mail/mailutils-3.12-r3"
 

References

• CVE-2021-32749

Release date
October 19, 2023

Latest revision
October 19, 2023: 1

Severity
high

Exploitable
remote

Bugzilla entries

• 802867