PT-2018-3530 · Marshal · Msmtp+1

Published 2018-12-13 · Updated 2024-06-15 · CVE-2019-8337

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: msmtp version 1.8.2 mpop version 1.4.3

Description: The issue is related to the tls trust file command in the msmtp and mpop clients, which is associated with improper certificate authentication verification. This could allow a remote attacker to impact the integrity, availability, and confidentiality of information.

Recommendations: For msmtp version 1.8.2, consider updating the configuration of tls trust file to properly check certificate-verification results. For mpop version 1.4.3, review and adjust the tls trust file settings to ensure correct authentication of certificates.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2020-03297

CVE-2019-8337

OPENSUSE-SU-2024:11064-1

Affected Products

Mpop

Msmtp

References · 15

• https://security-tracker.debian.org/tracker/CVE-2019-8337 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11064-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03297 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-8337 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-8337 · Vendor Advisory
• https://marlam.de/mpop/news/mpop-1-4-3 · Patch
• https://marlam.de/msmtp/news · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-8337 · Vendor Advisory
• https://gitlab.marlam.de/marlam/mpop/commit/b51a6c6b8b83bf0913cc52fa2ff64307e987a5b8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-8337 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-8337 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-8337 · Vendor Advisory
• https://git.marlam.de/gitweb/?p=msmtp.git;a=commit;h=a81d0a5126304f9f8b29a75d058044dc67d07663 · Note
• https://git.marlam.de/gitweb/?p=mpop.git;a=commit;h=95b96da443a24a4a9cb6664aefff9f6fcc7ac86e · Note
• https://suse.com/security/cve/CVE-2019-8337 · Note