CVE-2025-71063: 
NixOS vulnerability analysis and mitigation

CVE-2025-71063 is an improper TLS certificate validation vulnerability in Errands, a GNOME to-do list application, affecting all versions before 46.2.10. The application hardcoded ssl_verify_cert=False in its CalDAV sync provider, meaning it never verified TLS certificates when connecting to CalDAV servers. The issue was reported on August 15, 2025, and the fix was released on December 22, 2025 in version 46.2.10. The CVSS v3.1 base score is 7.5 (High) per NVD, and 8.2 (High) per the CNA (MITRE) (GitHub Issue, GitHub Release).

The root cause is CWE-295 (Improper Certificate Validation): in errands/lib/sync/providers/caldav.py, the DAVClient constructor was called with the hardcoded parameter ssl_verify_cert=False, completely disabling TLS certificate verification for all CalDAV connections (GitHub Commit). This allows an attacker on an adjacent network to perform man-in-the-middle (MITM) attacks by presenting a self-signed or otherwise invalid certificate that the client will silently accept. Exploitation requires the attacker to be positioned on the same network segment as the victim (adjacent network attack vector) and that the user has CalDAV sync configured. The fix, committed December 22, 2025, simply removes the ssl_verify_cert=False line, restoring the library's default behavior of enforcing certificate validation (GitHub Commit).

An attacker on an adjacent network can intercept and modify CalDAV traffic between the Errands application and the CalDAV server, compromising the confidentiality and integrity of calendar and task data. This could expose sensitive scheduling information, credentials transmitted over the connection, or allow injection of malicious calendar entries. The vulnerability does not directly affect availability in a significant way, but the interception of authentication credentials could enable further account compromise (Feedly, GitHub Issue).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.011% (0.000110), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for adjacent network positioning and an active CalDAV sync session (Feedly).

1. Reconnaissance: Identify a target using the Errands application (versions before 46.2.10) with CalDAV synchronization configured, on a shared or adjacent network (e.g., public Wi-Fi, corporate LAN).
2. Network Positioning: Position the attacker's machine on the same network segment as the victim using ARP spoofing or similar techniques to intercept traffic between the Errands client and the CalDAV server.
3. TLS Interception: Set up a MITM proxy (e.g., mitmproxy, Burp Suite) with a self-signed or attacker-controlled TLS certificate for the CalDAV server's hostname. Because ssl_verify_cert=False is hardcoded, the Errands client will accept any certificate without validation.
4. Data Interception/Modification: Capture plaintext CalDAV traffic including authentication credentials (username/password) and calendar/task data. Optionally inject or modify calendar entries in transit to manipulate the victim's data (GitHub Issue, GitHub Commit).

• Network: Unexpected ARP replies or ARP cache poisoning on the local network segment; TLS connections from the Errands process to a CalDAV server using an unrecognized or self-signed certificate (detectable via network monitoring tools).
• Logs: Absence of TLS certificate validation errors in application logs despite connecting to a server with an invalid certificate; unusual CalDAV sync activity at unexpected times.
• Process: The Errands application (errands) making outbound HTTPS connections to CalDAV endpoints while a MITM proxy is active on the network.

Users should upgrade Errands to version 46.2.10 or later, which re-enables TLS certificate verification by removing the ssl_verify_cert=False parameter from the CalDAV client initialization (GitHub Release, GitHub Commit). As a temporary workaround prior to patching, users should avoid using CalDAV sync on untrusted or public networks, and consider implementing network segmentation to reduce exposure to adjacent network threats. Debian users can track the fix via the associated bug report (Debian Bug).

The vulnerability was originally reported by a community member (GitHub user powerjungleopened) on August 15, 2025, who noted the hardcoded ssl_verify_cert=False and questioned why there was no user-facing option to control this behavior (GitHub Issue). The issue received limited broader media attention, with mentions on Mastodon (TheHackerWire) and Bluesky shortly after CVE publication in January 2026. The fix was straightforward and released by the maintainer without significant controversy.