CVE-2021-38370
published 2021-08-10CVE-2021-38370: In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.
PriorityP429medium5.9CVSS 3.1
AVNACHPRNUINSUCNIHAN
EPSS
1.57%
72.2th percentile
In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| alpine_project | alpine | < 2.25 | 2.25 |
| alpine_project | alpine | >= 0 < 2.25+dfsg1-1 | 2.25+dfsg1-1 |
| alpine_project | alpine | >= 0 < 2.25+dfsg1-1 | 2.25+dfsg1-1 |
| alpine_project | alpine | >= 0 < 2.25+dfsg1-1 | 2.25+dfsg1-1 |
| alpine_project | alpine | >= 0 < 2.20+dfsg1-2ubuntu0.1~esm1 | 2.20+dfsg1-2ubuntu0.1~esm1 |
| alpine_project | alpine | >= 0 < 2.21+dfsg1-1ubuntu0.1~esm1 | 2.21+dfsg1-1ubuntu0.1~esm1 |
| alpine_project | alpine | >= 0 < 2.22+dfsg1-1ubuntu0.1~esm1 | 2.22+dfsg1-1ubuntu0.1~esm1 |
| debian | alpine | < alpine 2.25+dfsg1-1 (bookworm) | alpine 2.25+dfsg1-1 (bookworm) |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Alpine vulnerabilities
vendor_ubuntu·2025-03-20·CVSS 7.5
CVE-2021-46853 [HIGH] Alpine vulnerabilities
Title: Alpine vulnerabilities
Summary: Several security issues were fixed in Alpine.
It was discovered that Alpine did not use a secure connection under
certain circumstances. A remote attacker could possibly use this issue to
leak sensitive information. (CVE-2020-14929)
It was discovered that Alpine could allow untagged responses from an
IMAP server before upgrading to a TLS connection. A remote attacker could
possibly use this issue to leak sensitive information. (CVE-2021-38370)
It was discovered that Alpine could crash when receiving certain SMTP
commands. A remote attacker could possibly use this issue to cause a denial
of service. (CVE-2021-46853)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2021-38370: alpine - In Alpine before 2.25, untagged responses from an IMAP server are accepted befor...
vendor_debian·2021·CVSS 5.9
CVE-2021-38370 [MEDIUM] CVE-2021-38370: alpine - In Alpine before 2.25, untagged responses from an IMAP server are accepted befor...
In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.
Scope: local
bookworm: resolved (fixed in 2.25+dfsg1-1)
bullseye: open
forky: resolved (fixed in 2.25+dfsg1-1)
sid: resolved (fixed in 2.25+dfsg1-1)
trixie: resolved (fixed in 2.25+dfsg1-1)
OSV
alpine vulnerabilities
osv·2025-03-20·CVSS 7.5
CVE-2020-14929 [HIGH] alpine vulnerabilities
alpine vulnerabilities
It was discovered that Alpine did not use a secure connection under
certain circumstances. A remote attacker could possibly use this issue to
leak sensitive information. (CVE-2020-14929)
It was discovered that Alpine could allow untagged responses from an
IMAP server before upgrading to a TLS connection. A remote attacker could
possibly use this issue to leak sensitive information. (CVE-2021-38370)
It was discovered that Alpine could crash when receiving certain SMTP
commands. A remote attacker could possibly use this issue to cause a denial
of service. (CVE-2021-46853)
GHSA
GHSA-2c2h-qvww-cw95: In Alpine through 2
ghsa_unreviewed·2022-05-24
CVE-2021-38370 [MEDIUM] CWE-77 GHSA-2c2h-qvww-cw95: In Alpine through 2
In Alpine through 2.24, untagged responses from an IMAP server are accepted before STARTTLS.
OSV
CVE-2021-38370: In Alpine before 2
osv·2021-08-10·CVSS 5.9
CVE-2021-38370 [MEDIUM] CVE-2021-38370: In Alpine before 2
In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-08-10
Published