CVE-2021-44026

NameCVE-2021-44026
DescriptionRoundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2840-1, DSA-5013-1
NVD severityhigh
Debian Bugs1000156

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
roundcube (PTS)stretch1.2.3+dfsg.1-4+deb9u6vulnerable
stretch (security)1.2.3+dfsg.1-4+deb9u9fixed
buster1.3.16+dfsg.1-1~deb10u1vulnerable
buster (security)1.3.17+dfsg.1-1~deb10u1fixed
bullseye1.4.11+dfsg.1-4vulnerable
bullseye (security)1.4.12+dfsg.1-1~deb11u1fixed
bookworm1.5.0+dfsg.1-2fixed
sid1.5.1+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
roundcubesourcestretch1.2.3+dfsg.1-4+deb9u9DLA-2840-1
roundcubesourcebuster1.3.17+dfsg.1-1~deb10u1DSA-5013-1
roundcubesourcebullseye1.4.12+dfsg.1-1~deb11u1DSA-5013-1
roundcubesource(unstable)1.5.0+dfsg.1-11000156

Notes

https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1 (1.4.12)
https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa (1.3.17)

Search for package or bug name: Reporting problems