Published: 21/06/2020 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.9 | Impact Score: 3.6 | Exploitability Score: 2.2

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Mutt prior to 1.14.4 and NeoMutt prior to 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."

Vulnerable Product	Search on Vulmon	Subscribe to Product
mutt mutt
debian debian linux 9.0
debian debian linux 10.0
neomutt neomutt
fedoraproject fedora 31
fedoraproject fedora 32
debian debian linux 8.0
canonical ubuntu linux 18.04
canonical ubuntu linux 19.10
canonical ubuntu linux 20.04
canonical ubuntu linux 16.04
canonical ubuntu linux 12.04
opensuse leap 15.1
opensuse leap 15.2

Mutt could be made to enable MITM attacks if it received a specially crafted request ...

Damian Poddebniak and Fabian Ising discovered two security issues in the STARTTLS handling of the Neomutt mail client, which could enable MITM attacks For the stable distribution (buster), these problems have been fixed in version 20180716+dfsg1-1+deb10u1 We recommend that you upgrade your neomutt packages For the detailed security status of ne ...

Mutt before 1143 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response (CVE-2020-14093) Mutt before 1143 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate (CVE-2020-14154) Mutt before 1144 and NeoMutt before 2020-06-19 have a STARTTLS bu ...

CWE-74 http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20200615/000023.html http://www.mutt.org/https://github.com/neomutt/neomutt/commit/fb013ec666759cb8a9e294347c7b4c1f597639cc https://gitlab.com/muttmua/mutt/-/commit/c547433cdf2e79191b15c6932c57f1472bfb5ff4 https://github.com/neomutt/neomutt/releases/tag/20200619 https://gitlab.com/muttmua/mutt/-/issues/248 https://www.debian.org/security/2020/dsa-4708 https://www.debian.org/security/2020/dsa-4707 http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00064.html http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00070.html https://lists.debian.org/debian-lts-announce/2020/06/msg00040.html https://lists.debian.org/debian-lts-announce/2020/06/msg00039.html https://usn.ubuntu.com/4403-1/https://security.gentoo.org/glsa/202007-57 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3LXFVPTLK4PNHL6MPKJNJQJ25CH7GLQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFMEILCBKMZRRZDMUGWLVN4PQQ4VTAZE/https://usn.ubuntu.com/4403-1/https://nvd.nist.gov

CVE-2020-14954

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect