CVE-2025-71063: Errands TLS Certificate Vulnerability

CVE-2025-71063 Overview

CVE-2025-71063 is a certificate validation bypass vulnerability affecting Errands, a GTK-based task management application, in versions prior to 46.2.10. The application fails to properly verify TLS certificates when connecting to CalDAV servers, allowing attackers on adjacent networks to perform man-in-the-middle attacks and intercept sensitive calendar and task data.

Critical Impact

Attackers on the same network segment can intercept, modify, or steal sensitive calendar and task synchronization data by exploiting the missing TLS certificate validation.

Affected Products

• Errands versions prior to 46.2.10
• Errands 46.2.9 and earlier releases
• All Errands installations configured with CalDAV synchronization

Discovery Timeline

• 2026-01-12 - CVE CVE-2025-71063 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-71063

Vulnerability Analysis

This vulnerability is classified as CWE-295 (Improper Certificate Validation), a critical cryptographic flaw that undermines the fundamental security guarantees of TLS/SSL communication. When Errands connects to a CalDAV server for calendar and task synchronization, it establishes an HTTPS connection but fails to validate the server's TLS certificate chain. This means the application accepts any certificate—including self-signed, expired, or malicious certificates—without verification.

The vulnerability requires the attacker to be on an adjacent network (such as the same local network, WiFi, or VLAN), which limits remote exploitation but makes it particularly dangerous in shared network environments like corporate offices, coffee shops, or public WiFi hotspots.

Root Cause

The root cause lies in the improper configuration of the TLS client implementation within Errands. When establishing connections to CalDAV servers for syncing tasks and calendar data, the application either explicitly disables certificate verification or uses a permissive SSL context that trusts all certificates regardless of their validity, chain of trust, or expiration status. This implementation oversight bypasses the core security mechanism of TLS that protects against impersonation attacks.

Attack Vector

An attacker positioned on the same network segment as the victim can exploit this vulnerability through the following attack scenario:

1. The attacker sets up a rogue access point or performs ARP spoofing to intercept network traffic
2. When the Errands application initiates a connection to a legitimate CalDAV server, the attacker intercepts the connection
3. The attacker presents their own TLS certificate to the Errands client
4. Due to the missing certificate validation, Errands accepts the fraudulent certificate
5. The attacker can now decrypt, inspect, and modify all CalDAV traffic between the user and server

This attack allows the adversary to steal authentication credentials, read sensitive calendar entries and tasks, inject malicious data, or perform account takeover if credentials are captured.

The technical details of this vulnerability can be reviewed in the GitHub Commit Details which shows the fix implementing proper certificate validation.

Detection Methods for CVE-2025-71063

Indicators of Compromise

• Unexpected certificate warnings or changes when connecting to CalDAV servers
• Network traffic to CalDAV servers originating from unexpected IP addresses
• TLS connections to CalDAV endpoints using suspicious or self-signed certificates
• Authentication failures followed by successful logins from different network locations

Detection Strategies

• Monitor network traffic for TLS connections with certificate chain anomalies to CalDAV endpoints
• Implement network-level certificate transparency monitoring to detect rogue certificates
• Deploy intrusion detection rules to identify ARP spoofing or man-in-the-middle attack patterns
• Review application logs for unusual CalDAV synchronization patterns or connection errors

Monitoring Recommendations

• Enable TLS inspection on network security appliances to validate certificate chains
• Monitor for ARP cache poisoning attacks on network segments where Errands is deployed
• Implement certificate pinning validation at the network perimeter for known CalDAV services
• Track Errands version deployments across the organization to identify unpatched installations

How to Mitigate CVE-2025-71063

Immediate Actions Required

• Upgrade Errands to version 46.2.10 or later immediately
• Audit all CalDAV synchronization configurations for potential data exposure
• Review network logs for signs of man-in-the-middle attacks during the vulnerable period
• Consider rotating CalDAV account credentials if exploitation is suspected

Patch Information

The vulnerability is addressed in Errands version 46.2.10. The fix implements proper TLS certificate validation for all CalDAV server connections. Users should upgrade immediately to the patched version.

Patch details are available in the following resources:

• GitHub Release v46.2.10 - Official release with the security fix
• GitHub Version Comparison - Detailed changes between versions
• Debian Bug Report #1123738 - Distribution-specific tracking

Workarounds

• Avoid using CalDAV synchronization on untrusted networks until patched
• Use VPN connections when synchronizing on public or shared networks
• Configure network segmentation to isolate devices running vulnerable Errands versions
• Consider using alternative task management applications with proper TLS validation until upgrade is complete

# Verify Errands version to confirm patched status
flatpak info io.github.mrvladus.List 2>/dev/null | grep -i version
# or check via package manager
errands --version

# Update Errands via Flatpak
flatpak update io.github.mrvladus.List

# For Debian-based distributions, update via apt
sudo apt update && sudo apt upgrade errands