PT-2019-6588 · Offlineimap · Offlineimap

Jan Lieskovsky · Publicado 2019-11-13 · Atualizado 2020-08-18 · CVE-2010-4533

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions offlineimap versions prior to 6.3.4

Description The issue concerns the use of the SSL v2 protocol, which has multiple security deficiencies. Although offlineimap added support for SSL server certificate validation before version 6.3.4, it is still possible to use the flawed SSL v2 protocol.

Recommendations For versions prior to 6.3.4, update to version 6.3.4 or later to mitigate the risk associated with the use of the SSL v2 protocol.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2010-4533

Produtos afetados

Offlineimap

Referências · 7

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4533 · Nota
• https://access.redhat.com/security/cve/cve-2010-4533 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4533 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2010-4533 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2010/12/23/2 · Correção
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606962 · Nota
• https://security-tracker.debian.org/tracker/CVE-2010-4533 · Aviso do Fabricante