This page last updated 2013-04-23.

Fetchmail source code repository

Fetchmail is currently managed with Git in a repository hosted by Gitorious in Norway. Please see http://gitorious.org/fetchmail for details.

Mirror of the official fetchmail website

Click here to go to the mirror of the official fetchmail website.

Fetchmail security information

2012-08-29 CVE-2012-3482: DoS/data theft possible in NTLM authentication
2012-08-29 CVE-2011-3389: Countermeasure in SSL against chosen plaintext attacks in block ciphers
2011-06-06 CVE-2011-1947: Denial of service possible in STARTTLS mode
2010-05-06 CVE-2010-1167: unbounded allocation of memory in -v -v verbose mode on some computers (for instance openSUSE Linux 11.2 i686) in multibyte locales (for instance UTF-8) on invalid input characters.
2010-02-05 CVE-2010-0562: heap corruption with characters >0x80 in verbose mode when printing SSL/TLS X.509 certificates on platforms with signed characters.
2009-08-06 CVE-2009-2666: SSL/TLS improper validation of certificates with NUL prefixes (fixed in 6.3.11).
2008-06-17 CVE-2008-2711: Denial of Service on long headers in -v -v verbose mode (fixed in 6.3.9-rc2).
2007-08-28 CVE-2007-4565: Denial of Service when a locally-generated warning message is rejected (fixed in 6.3.9-rc1).
2007-04-06 CVE-2007-1558: APOP considered insecure, fetchmail implementation too lax (strengthened in 6.3.8)
2007-01-04 CVE-2006-5974: crash when refusing message with --mda delivery (new in 6.3.5, fixed in 6.3.6)
2007-02-18 CVE-2006-5867: password disclosure (long-standing, fixed in 6.3.6)
2006-01-22 CVE-2006-0321: denial of service when bouncing bad addresses in 6.3.0 and 6.3.1 (fixed in 6.3.2)
2006-01-22 fetchmail 6.2.X was discontinued at this point, it is known since late 2006 to be vulnerable to CVE-2006-5867 above.
2005-12-19 CVE-2005-4348: denial of service in multidrop mode in 6.2.5.X before 6.2.5.5 and in 6.3.0 (fixed in 6.2.5.5 and 6.3.1)
2005-11-30 fetchmail 6.3.0 was released
2005-10-21 CVE-2005-3088: password exposure in fetchmailconf before 6.2.5.4
2005-07-21 CVE-2005-2335: remote root in fetchmail before 6.2.5.2

Fetchmail 7.0.0-alpha4 preview version

new 2013-01-02
fetchmail-7.0.0-alpha4.tar.xz * GnuPG signature (detached ASCII armor)
read these changes in 7.0.0-alpha*

Please report all troubles you find in this version to the fetchmail-devel@lists.berlios.de mailing list.

As any free software, this comes without warranty - use at your own risk!

Fetchmail 6.3.26 release

new 2013-04-23
fetchmail-6.3.26.tar.bz2 * GnuPG signature
fetchmail-6.3.26.tar.xz * GnuPG signature
changes since 6.0.0

As any free software, this comes without warranty - use at your own risk!

Fetchmail patches

This web site collects a few older patches on top of fetchmail package. If used, they must be applied in order shown, on top of fetchmail 6.2.5

Sunil Shetye's feature patch: fetchmail-6.2.5-ss1.patch
My bugfix patch: fetchmail-6.2.5-ss1-ma3.patch

These patches add a new handling for UID files and improve UIDL handling for POP3 and IMAP, with Sunil's Fast UIDL mode that now works outside daemon mode as well. It will erase your old ~/.fetchids file on first run and save the UIDs to files in a ~/.fetchmail directory instead.

I also have a helper script to revert the new .fetchmail/*-* ID files to the old .fetchids format. It requires Perl and is named fetchmail-6.2.5-fetchids-revert.pl

Fetchmail Subversion archive

Fetchmail has been converted to a Git repository on 2010-02-06. I keep an archive of the former server-side Subversion repository as a ~10 MB .tar.xz file here:
fetchmail.svnrepo.backup.tar.xz * [GnuPG signature]

Matthias Andree