VulnerabilityModified
CVE-2020-28896
This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.
MEDIUM 5.3EPSS 2.35%
Does this matter?
Lower severity and a low EPSS score (2.35%). Track it; it rarely justifies an emergency change on its own.
Description
Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 2.35% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287, CWE-755
- Affected
- mutt/mutt · neomutt/neomutt · debian/debian linux
- Source
- cve@mitre.org
References
- https://github.com/neomutt/neomutt/commit/9c36717a3e2af1f2c1b7242035455ec8112b4b06Patch, Third Party Advisory
- https://github.com/neomutt/neomutt/releases/tag/20201120Release Notes, Third Party Advisory
- https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59aPatch, Third Party Advisory
- https://gitlab.com/muttmua/mutt/-/commit/d92689088dfe80a290ec836e292376e2d9984f8fPatch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/11/msg00048.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202101-32Third Party Advisory
- https://github.com/neomutt/neomutt/commit/9c36717a3e2af1f2c1b7242035455ec8112b4b06Patch, Third Party Advisory
- https://github.com/neomutt/neomutt/releases/tag/20201120Release Notes, Third Party Advisory
- https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59aPatch, Third Party Advisory
- https://gitlab.com/muttmua/mutt/-/commit/d92689088dfe80a290ec836e292376e2d9984f8fPatch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/11/msg00048.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202101-32Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.