Canary Mail and MailCore2 library missing certificate validation check on IMAP STARTTLS

CENSUS ID:	CENSUS-2021-0001
CVE ID:	CVE-2021-26911
Affected Products:	Canary Mail for iOS and MacOS versions 3.20 and 3.21, MailCore2 library version 0.6.4
Class:	Improper Certificate Validation (CWE-295)
Discovered by:	Rayd Debbas

CENSUS identified that the Canary Mail software in versions 3.20 and 3.21 (and possibly previous versions) is missing a certificate validation check when performing an IMAP connection configured with STARTTLS. This vulnerability allows man-in-the-middle attackers to collect a victim user's email credentials (while these are communicated to the IMAP service), to access email messages and perform other IMAP actions to the victim account, but also to modify email messages while in-transit to Canary Mail. CENSUS strongly recommends to iOS and MacOS users of the Canary Mail software to update to version 3.22, as this version carries a fix for the aforementioned vulnerability. The same vulnerability also affects other software that are based on the MailCore2 library (including version 0.6.4). A patch for the library is publicly available, however this has not been incorporated yet into an official library release.