CVE-2025-71063
📋 TL;DR
Errands versions before 46.2.10 fail to validate TLS certificates when connecting to CalDAV servers, allowing man-in-the-middle attackers to intercept or manipulate calendar data. This affects all users of Errands who sync with CalDAV servers over untrusted networks.
💻 Affected Systems
- Errands
📦 What is this software?
Errands by Mrvladus
⚠️ Risk & Real-World Impact
Worst Case
Attackers could intercept sensitive calendar data, inject malicious events, or steal authentication credentials via man-in-the-middle attacks on unsecured connections.
Likely Case
Calendar data exposure or manipulation when users connect to CalDAV servers over public or compromised networks.
If Mitigated
Limited impact if connections only occur over trusted internal networks with proper network segmentation.
🎯 Exploit Status
Requires man-in-the-middle position between client and CalDAV server.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 46.2.10
Vendor Advisory: https://github.com/mrvladus/Errands/releases/tag/46.2.10
Restart Required: Yes
Instructions:
1. Update Errands to version 46.2.10 or later. 2. Restart the application. 3. Verify TLS certificate validation is now enforced for CalDAV connections.
🔧 Temporary Workarounds
Disable CalDAV synchronization
allTemporarily disable calendar synchronization with CalDAV servers until patched.
Use VPN for CalDAV connections
allRoute all CalDAV traffic through a trusted VPN to prevent man-in-the-middle attacks.
🧯 If You Can't Patch
- Only use CalDAV synchronization over trusted internal networks
- Implement network monitoring for unexpected certificate warnings or connection errors
🔍 How to Verify
Check if Vulnerable:
Check Errands version in application settings or via 'errands --version' command. If version is earlier than 46.2.10 and CalDAV is configured, system is vulnerable.Check Version:
errands --versionVerify Fix Applied:
After updating to 46.2.10+, test CalDAV connection with an invalid certificate - application should reject the connection.📡 Detection & Monitoring
Log Indicators:
- Certificate validation errors
- Failed CalDAV connections
- Unexpected certificate warnings
Network Indicators:
- Unencrypted or improperly encrypted CalDAV traffic
- Certificate validation bypass attempts
SIEM Query:
source="errands.log" AND ("certificate" OR "TLS" OR "CalDAV") AND ("error" OR "warning" OR "failed")🔗 References
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1123738
- https://github.com/mrvladus/Errands/commit/04e567b432083fc798ea2249363ea6c83ff01099
- https://github.com/mrvladus/Errands/compare/46.2.9...46.2.10
- https://github.com/mrvladus/Errands/issues/401
- https://github.com/mrvladus/Errands/releases/tag/46.2.10
