PT-2019-6588 · Offlineimap · Offlineimap

Jan Lieskovsky · Published 2019-11-13 · Updated 2020-08-18 · CVE-2010-4533

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions offlineimap versions prior to 6.3.4

Description The issue concerns the use of the SSL v2 protocol, which has multiple security deficiencies. Although offlineimap added support for SSL server certificate validation before version 6.3.4, it is still possible to use the flawed SSL v2 protocol.

Recommendations For versions prior to 6.3.4, update to version 6.3.4 or later to mitigate the risk associated with the use of the SSL v2 protocol.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2010-4533

Affected Products

Offlineimap

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2010-4533 · Security Note
• https://osv.dev/vulnerability/CVE-2010-4533 · Vendor Advisory
• https://openwall.com/lists/oss-security/2010/12/23/2 · Patch
• https://security-tracker.debian.org/tracker/CVE-2010-4533 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4533 · Note
• https://access.redhat.com/security/cve/cve-2010-4533 · Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606962 · Note