CVE-2021-44026

NameCVE-2021-44026
DescriptionRoundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2840-1, DSA-5013-1
Debian Bugs1000156

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
roundcube (PTS)buster1.3.17+dfsg.1-1~deb10u2fixed
buster (security)1.3.17+dfsg.1-1~deb10u5fixed
bullseye (security), bullseye1.4.15+dfsg.1-1~deb11u2fixed
bookworm, bookworm (security)1.6.5+dfsg-1~deb12u1fixed
sid, trixie1.6.6+dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
roundcubesourcestretch1.2.3+dfsg.1-4+deb9u9DLA-2840-1
roundcubesourcebuster1.3.17+dfsg.1-1~deb10u1DSA-5013-1
roundcubesourcebullseye1.4.12+dfsg.1-1~deb11u1DSA-5013-1
roundcubesource(unstable)1.5.0+dfsg.1-11000156

Notes

https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1 (1.4.12)
https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa (1.3.17)

Search for package or bug name: Reporting problems