NetSight
IP …
medium5.9

CVE-2020-14954

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3.

Impact

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."

Affected products

VendorProductAffected versions
MuttMutt
before 1.14.4
DebianDebian Linux
Versions 9.0, 10.0, 8.0
NeomuttNeomutt
before 20200619
FedoraprojectFedora
Versions 31, 32
CanonicalUbuntu Linux
Versions 12.04, 16.04, 18.04, 19.10, 20.04
OpensuseLeap
Versions 15.1, 15.2

Weakness classification

CWE-74

References