Mutt · Mutt · CVE-2020-14954
Name of the Vulnerable Software and Affected Versions:
Mutt versions prior to 1.14.4
NeoMutt versions prior to 2020-06-19
Description:
The issue is related to a STARTTLS buffering problem that affects IMAP, SMTP, and POP3 protocols. When a server sends a "begin TLS" response, the client reads additional data and evaluates it in a TLS context, which can lead to "response injection." This can potentially allow a remote attacker to gain unauthorized access to protected information.
Recommendations:
For Mutt versions prior to 1.14.4, update to version 1.14.4 or later.
For NeoMutt versions prior to 2020-06-19, update to a version released after 2020-06-19.
As a temporary workaround, consider restricting the use of STARTTLS to minimize the risk of exploitation.