| Summary: | Updated mutt packages fix security vulnerabilities (CVE-2020-14093). (CVE-2020-28896) (CVE-2021-3181) | ||
|---|---|---|---|
| Product: | [ROSA-based products] ROSA Fresh | Reporter: | Zombie Ryushu <zombie.ryushu> |
| Component: | Contributed Packages | Assignee: | ROSA Linux Bugs <bugs> |
| Status: | CONFIRMED --- | QA Contact: | ROSA Linux Bugs <bugs> |
| Severity: | normal | ||
| Priority: | Normal | CC: | alzim, andrey.bondrov, denis.silakov, mc2374 |
| Version: | KDE4 | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://advisories.mageia.org/MGASA-2020-0357.html | ||
| Whiteboard: | |||
| Platform: | 2016.1 | ROSA Vulnerability identifier: | CVE-2020-14093 (CVE-2020-28896) (CVE-2021-3181) |
| RPM Package: | mutt-1.11.4-1.4.mga7 | ISO-related: | |
| Bad POT generating: | Upstream: | ||
|
Description
Zombie Ryushu
2020-11-20 02:34:54 MSK
Mutt before 2.0.2 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle (CVE-2020-28896). It was discovered that Mutt incorrectly handled certain email messages. An attacker could possibly use this issue to cause a denial of service because rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). (CVE-2021-3181). mutt-1.11.4 has been patched for Mageia 7. https://advisories.mageia.org/MGASA-2021-0070.html |