PT-2019-7730 · Imapfilter+2 · Imapfilter+2

Asentierio · Publicado 2019-09-08 · Atualizado 2023-02-16 · CVE-2016-10937

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions IMAPFilter versions prior to 2.6.13

Description The issue is related to the failure of IMAPFilter to validate the hostname in an SSL certificate. This could potentially lead to security issues, but specific details about the estimated number of affected devices or real-world incidents are not provided.

Recommendations For IMAPFilter versions prior to 2.6.13, update to version 2.6.13 or later to resolve the issue. As a temporary workaround, consider disabling SSL certificate validation until a patch is available, but this is not recommended due to the potential security risks. Restrict access to sensitive information to minimize the risk of exploitation.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

ALT-PU-2021-1130

ALT-PU-2021-1203

CVE-2016-10937

DLA-1976-1

OPENSUSE-SU-2020:0673-1

OPENSUSE-SU-2020:0765-1

OPENSUSE-SU-2020_0673-1

Produtos afetados

Alt Linux

Imapfilter

Suse

Referências · 22

• https://github.com/lefcha/imapfilter/issues/142 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10937 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10937 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2020:0765-1 · Aviso do Fabricante
• https://lists.opensuse.org/archives/list/[e-mail]/thread/JJS2TEESN3PSKIVXSB6D3LM2NGPCDUBE · Nota
• https://cve.org/CVERecord?id=CVE-2016-10937 · Nota de Segurança
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00042.html · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2019/10/msg00040.html · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GBNDFMAIUA6PQMV2P6OKIP7JZQEWX7D2 · Aviso do Fabricante
• https://lists.opensuse.org/archives/list/[e-mail]/thread/V25HZ3S35SLV7AXDPCRNJRAEWG7CGW7U · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2020:0673-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10937 · Aviso do Fabricante
• https://t.me/cibsecurity/6589 · Publicação no Telegram
• https://ubuntu.com/security/CVE-2016-10937 · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-1976-1 · Aviso do Fabricante