CVE-2020-28896
Publication date 23 November 2020
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.
Status
Package | Ubuntu Release | Status |
---|---|---|
mutt | 24.10 oracular |
Not affected
|
24.04 LTS noble |
Not affected
|
|
22.04 LTS jammy |
Not affected
|
|
20.04 LTS focal |
Fixed 1.13.2-1ubuntu0.3
|
|
18.04 LTS bionic |
Fixed 1.9.4-3ubuntu0.4
|
|
16.04 LTS xenial |
Fixed 1.5.24-1ubuntu0.5
|
|
14.04 LTS trusty | Not in release | |
neomutt | 24.10 oracular |
Not affected
|
24.04 LTS noble |
Not affected
|
|
22.04 LTS jammy |
Not affected
|
|
20.04 LTS focal |
Vulnerable
|
|
18.04 LTS bionic |
Vulnerable
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 5.3 · Medium |
Attack vector | Network |
Attack complexity | High |
Privileges required | None |
User interaction | Required |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | None |
Availability impact | None |
Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-4645-1
- Mutt vulnerability
- 25 November 2020