CVE-2020-28896
Summary
| CVE | CVE-2020-28896 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-11-23 19:15:00 UTC |
| Updated | 2021-07-21 11:39:00 UTC |
| Description | Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle. |
Risk And Classification
Problem Types: CWE-287 | CWE-755
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Application | Mutt | Mutt | All | All | All | All |
| Application | Mutt | Mutt | All | All | All | All |
| Application | Neomutt | Neomutt | All | All | All | All |
| Application | Neomutt | Neomutt | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Release NeoMutt 2020-11-20 · neomutt/neomutt · GitHub | MISC | github.com | Release Notes, Third Party Advisory |
| imap: close connection on all failures · neomutt/neomutt@9c36717 · GitHub | MISC | github.com | Patch, Third Party Advisory |
| [SECURITY] [DLA 2472-1] mutt security update | MLIST | lists.debian.org | Mailing List, Third Party Advisory |
| Ensure IMAP connection is closed after a connection error. (04b06aaa) · Commits · Mutt Project / mutt · GitLab | MISC | gitlab.com | Patch, Third Party Advisory |
| Mutt, NeoMutt: Information disclosure (GLSA 202101-32) — Gentoo security | GENTOO | security.gentoo.org | Third Party Advisory |
| automatic post-release commit for mutt-2.0.2 (d9268908) · Commits · Mutt Project / mutt · GitLab | MISC | gitlab.com | Patch, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159902 Oracle Enterprise Linux Security Update for mutt (ELSA-2021-4181)
- 239818 Red Hat Update for mutt security (RHSA-2021:4181)
- 354118 Amazon Linux Security Advisory for mutt : ALAS2-2022-1892
- 501632 Alpine Linux Security Update for mutt
- 670191 EulerOS Security Update for mutt (EulerOS-SA-2021-1690)
- 690396 Free Berkeley Software Distribution (FreeBSD) Security Update for mutt (dc132c91-2b71-11eb-8cfd-4437e6ad11c4)
- 750523 OpenSUSE Security Update for mutt (openSUSE-SU-2020:2141-1)
- 750529 OpenSUSE Security Update for mutt (openSUSE-SU-2020:2128-1)
- 750531 OpenSUSE Security Update for neomutt (openSUSE-SU-2020:2127-1)
- 940384 AlmaLinux Security Update for mutt (ALSA-2021:4181)
- 960372 Rocky Linux Security Update for mutt (RLSA-2021:4181)