PT-2019-7730 · Imapfilter+2 · Imapfilter+2

Asentierio · Published 2019-09-08 · Updated 2023-02-16 · CVE-2016-10937

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions IMAPFilter versions prior to 2.6.13

Description The issue is related to the failure of IMAPFilter to validate the hostname in an SSL certificate. This could potentially lead to security issues, but specific details about the estimated number of affected devices or real-world incidents are not provided.

Recommendations For IMAPFilter versions prior to 2.6.13, update to version 2.6.13 or later to resolve the issue. As a temporary workaround, consider disabling SSL certificate validation until a patch is available, but this is not recommended due to the potential security risks. Restrict access to sensitive information to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2021-1130

ALT-PU-2021-1203

CVE-2016-10937

DLA-1976-1

OPENSUSE-SU-2020:0673-1

OPENSUSE-SU-2020:0765-1

OPENSUSE-SU-2020_0673-1

Affected Products

Alt Linux

Imapfilter

Suse

References · 22

• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10937 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10937 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2020:0765-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-10937 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00042.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GBNDFMAIUA6PQMV2P6OKIP7JZQEWX7D2 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0673-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10937 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10937 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1976-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-10937 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-10937 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IQUH2TOCNEST7JB2RJVVJT3RZS5XZCFZ · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00002.html · Vendor Advisory
• https://github.com/lefcha/imapfilter/issues/142 · Note