Bugzilla – Bug 1172935
VUL-0: CVE-2020-14093: mutt,neomutt: IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response
Last modified: 2021-08-09 11:41:52 UTC
CVE-2020-14093 Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response. STARTTLS is not allowed in the Authenticated state, so previously Mutt would implicitly mark the connection as authenticated and skip any encryption checking/enabling. No credentials are exposed, but it does allow messages to be sent to an attacker, via postpone or fcc'ing for instance. References: https://gitlab.com/muttmua/mutt/-/commit/3e88866dc60b5fa6aaba6fd7c1710c12c1c3cd01 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14093 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14093
SUSE:SLE-10-SP3:Update mutt Affected SUSE:SLE-11:Update mutt Affected SUSE:SLE-12:Update mutt Affected SUSE:SLE-15:Update mutt Affected
(In reply to Wolfgang Frisch from comment #1) > SUSE:SLE-10-SP3:Update mutt Affected > SUSE:SLE-11:Update mutt Affected > SUSE:SLE-12:Update mutt Affected > SUSE:SLE-15:Update mutt Affected Ohmm ... this looks like a duplicate of bug #1172906
(In reply to Dr. Werner Fink from comment #2) > (In reply to Wolfgang Frisch from comment #1) > > SUSE:SLE-10-SP3:Update mutt Affected > > SUSE:SLE-11:Update mutt Affected > > SUSE:SLE-12:Update mutt Affected > > SUSE:SLE-15:Update mutt Affected > > Ohmm ... this looks like a duplicate of bug #1172906 You're right. I checked the CVE and the other bug did not have one yet. *** This bug has been marked as a duplicate of bug 1172906 ***
This is an autogenerated message for OBS integration: This bug (1172935) was mentioned in https://build.opensuse.org/request/show/816866 Factory / mutt
SUSE-SU-2020:1771-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1172906,1172935,1173197 CVE References: CVE-2020-14093,CVE-2020-14154,CVE-2020-14954 Sources used: SUSE Linux Enterprise Server for SAP 15 (src): mutt-1.10.1-3.8.1 SUSE Linux Enterprise Server 15-LTSS (src): mutt-1.10.1-3.8.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): mutt-1.10.1-3.8.1 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): mutt-1.10.1-3.8.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): mutt-1.10.1-3.8.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): mutt-1.10.1-3.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:1794-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1172906,1172935,1173197 CVE References: CVE-2020-14093,CVE-2020-14154,CVE-2020-14954 Sources used: SUSE OpenStack Cloud Crowbar 8 (src): mutt-1.10.1-55.11.1 SUSE OpenStack Cloud 8 (src): mutt-1.10.1-55.11.1 SUSE OpenStack Cloud 7 (src): mutt-1.10.1-55.11.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): mutt-1.10.1-55.11.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): mutt-1.10.1-55.11.1 SUSE Linux Enterprise Server 12-SP5 (src): mutt-1.10.1-55.11.1 SUSE Linux Enterprise Server 12-SP4 (src): mutt-1.10.1-55.11.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): mutt-1.10.1-55.11.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): mutt-1.10.1-55.11.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): mutt-1.10.1-55.11.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): mutt-1.10.1-55.11.1 SUSE Enterprise Storage 5 (src): mutt-1.10.1-55.11.1 HPE Helion Openstack 8 (src): mutt-1.10.1-55.11.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:0915-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1172906,1172935,1173197 CVE References: CVE-2020-14093,CVE-2020-14154,CVE-2020-14954 Sources used: openSUSE Leap 15.2 (src): mutt-1.10.1-lp152.3.3.1
SUSE-SU-2020:14414-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1172906,1172935,1173197 CVE References: CVE-2020-14093,CVE-2020-14154,CVE-2020-14954 Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): mutt-1.5.17-42.51.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): mutt-1.5.17-42.51.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): mutt-1.5.17-42.51.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): mutt-1.5.17-42.51.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
These did not get fixed for neomutt
This is an autogenerated message for OBS integration: This bug (1172935) was mentioned in https://build.opensuse.org/request/show/850817 15.1+15.2 / neomutt
openSUSE-SU-2020:2127-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1172906,1172935,1173197,1179035,1179113 CVE References: CVE-2020-14093,CVE-2020-14154,CVE-2020-14954,CVE-2020-28896 JIRA References: Sources used: openSUSE Leap 15.2 (src): neomutt-20201120-lp152.2.3.1 openSUSE Leap 15.1 (src): neomutt-20201120-lp151.2.3.1
openSUSE-SU-2020:2157-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1172906,1172935,1173197,1179035,1179113 CVE References: CVE-2020-14093,CVE-2020-14154,CVE-2020-14954,CVE-2020-28896 JIRA References: Sources used: openSUSE Backports SLE-15-SP1 (src): neomutt-20201120-bp151.3.3.1
openSUSE-SU-2020:2158-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1172906,1172935,1173197,1179035,1179113 CVE References: CVE-2020-14093,CVE-2020-14154,CVE-2020-14954,CVE-2020-28896 JIRA References: Sources used: openSUSE Backports SLE-15-SP2 (src): neomutt-20201120-bp152.2.3.1
Released.