CVE catalog

CVE-2021-31439

DEBIAN-CVE-2021-31439

Severity: High · CVSS 8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: May 21, 2021, 3:15:00 PM UTC
Updated: Sep 1, 2026, 8:04:28 PM UTC
Source: [NVD] · [CVE record]
EPSS: 2.33% · Oct 25, 2026

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager. Authentication is not required to exploit this vulnerablity. The specific flaw exists within the processing of DSI structures in Netatalk. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12326.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	netatalk	13	`3.1.13~ds-1`	fixed
Debian	netatalk	14	`3.1.13~ds-1`	fixed
Ubuntu	netatalk	pro	`2.2.6-1`	vulnerable
Ubuntu	netatalk	pro	`2.2.6-1ubuntu0.18.04.2`	vulnerable
Ubuntu	netatalk	pro	`2.2.6-1ubuntu0.18.04.2+esm1`	fixed
Ubuntu	netatalk	20.04	`3.1.12~ds-3`	vulnerable
Ubuntu	netatalk	20.04	`3.1.12~ds-4`	vulnerable
Ubuntu	netatalk	20.04	`3.1.12~ds-4ubuntu0.20.04.1`	fixed
Ubuntu	netatalk	22.04	`3.1.12~ds-9`	vulnerable
Ubuntu	netatalk	22.04	`3.1.12~ds-9build1`	vulnerable
Ubuntu	netatalk	22.04	`3.1.12~ds-9ubuntu0.22.04.1`	fixed
Debian	netatalk	11	`3.1.12~ds-8`	vulnerable
Debian	netatalk	11	`3.1.12~ds-8+deb11u1`	fixed
Debian	netatalk	10	`3.1.12~ds-3`	vulnerable
Debian	netatalk	10	`3.1.12~ds-3+deb10u1`	fixed
Suse	netatalk	linux enterprise software development kit 12 sp5	`3.1.0-3.8.1`	fixed
Suse	netatalk	linux enterprise workstation extension 12 sp5	`3.1.0-3.8.1`	fixed
Ubuntu	netatalk	20.04	`3.1.12~ds-3`	vulnerable
Ubuntu	netatalk	20.04	`3.1.12~ds-4`	vulnerable
Ubuntu	netatalk	20.04	`3.1.12~ds-4ubuntu0.20.04.1`	fixed
Ubuntu	netatalk	22.04	`3.1.12~ds-9`	vulnerable
Ubuntu	netatalk	22.04	`3.1.12~ds-9build1`	vulnerable
Ubuntu	netatalk	22.04	`3.1.12~ds-9ubuntu0.22.04.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	netatalk	deb	13	`3.1.13~ds-1`	Not reported	DEBIAN-CVE-2021-31439	Not reported
Debian	netatalk	deb	14	`3.1.13~ds-1`	Not reported	DEBIAN-CVE-2021-31439	Not reported
Ubuntu	netatalk	deb	pro	`2.2.6-1ubuntu0.18.04.2+esm1`	Not reported	USN-6146-1	Not reported
Ubuntu	netatalk	deb	20.04	`3.1.12~ds-4ubuntu0.20.04.1`	Not reported	USN-6146-1	Not reported
Ubuntu	netatalk	deb	22.04	`3.1.12~ds-9ubuntu0.22.04.1`	Not reported	USN-6146-1	Not reported
Debian	netatalk	deb	11	`3.1.12~ds-8+deb11u1`	Not reported	DSA-5503-1	Not reported
Debian	netatalk	deb	10	`3.1.12~ds-3+deb10u1`	Not reported	DLA-3426-1	Not reported
Suse	netatalk	rpm	linux enterprise software development kit 12 sp5	`3.1.0-3.8.1`	Not reported	SUSE-SU-2022:1184-1	Not reported
Suse	netatalk	rpm	linux enterprise workstation extension 12 sp5	`3.1.0-3.8.1`	Not reported	SUSE-SU-2022:1184-1	Not reported
Ubuntu	netatalk	deb	20.04	`3.1.12~ds-4ubuntu0.20.04.1`	Not reported	UBUNTU-CVE-2021-31439	Not reported
Ubuntu	netatalk	deb	22.04	`3.1.12~ds-9ubuntu0.22.04.1`	Not reported	UBUNTU-CVE-2021-31439	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 13 (Trixie)]

[a2boot]Unknown
Source package: [netatalk]
Details (4)
- 4.2.3~ds-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
[atalkd]Unknown
Source package: [netatalk]
Details (4)
- 4.2.3~ds-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
[libatalk]Unknown
Source package: [netatalk]
Details (4)
- 4.2.3~ds-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
[libatalk-dev]Unknown
Source package: [netatalk]
Details (4)
- 4.2.3~ds-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
[macipgw]Unknown
Source package: [netatalk]
Details (4)
- 4.2.3~ds-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
[netatalk]Unknown
Details (4)
- 4.2.3~ds-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
[netatalk-doc]Unknown
Source package: [netatalk]
Details (4)
- 4.2.3~ds-1+deb13u2 · all · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · all · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · all · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · all · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
[netatalk-tests]Unknown
Source package: [netatalk]
Details (4)
- 4.2.3~ds-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
[netatalk-tools]Unknown
Source package: [netatalk]
Details (4)
- 4.2.3~ds-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
[papd]Unknown
Source package: [netatalk]
Details (4)
- 4.2.3~ds-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
[timelord]Unknown
Source package: [netatalk]
Details (4)
- 4.2.3~ds-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13
- 4.2.3~ds-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.1.13~ds-1
  pypi · netatalk · debian · 13

Observed: Oct 23, 2026, 5:56:52 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]