CVE-2021-44025

NameCVE-2021-44025
DescriptionRoundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2840-1, DSA-5013-1
NVD severitymedium
Debian Bugs1000156

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
roundcube (PTS)stretch1.2.3+dfsg.1-4+deb9u6vulnerable
stretch (security)1.2.3+dfsg.1-4+deb9u9fixed
buster1.3.16+dfsg.1-1~deb10u1vulnerable
buster (security)1.3.17+dfsg.1-1~deb10u1fixed
bullseye1.4.11+dfsg.1-4vulnerable
bullseye (security)1.4.12+dfsg.1-1~deb11u1fixed
bookworm1.5.0+dfsg.1-2fixed
sid1.5.1+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
roundcubesourcestretch1.2.3+dfsg.1-4+deb9u9DLA-2840-1
roundcubesourcebuster1.3.17+dfsg.1-1~deb10u1DSA-5013-1
roundcubesourcebullseye1.4.12+dfsg.1-1~deb11u1DSA-5013-1
roundcubesource(unstable)1.5.0+dfsg.1-11000156

Notes

https://github.com/roundcube/roundcubemail/issues/8193
https://github.com/roundcube/roundcubemail/commit/faf99bf8a2b7b7562206fa047e8de652861e624a (1.4.12)
https://github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7 (1.3.17)

Search for package or bug name: Reporting problems