PT-2020-14066 · Alpine+3 · Alpine+3

Published 2020-06-19 · Updated 2025-03-20 · CVE-2020-14929

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Alpine versions prior to 2.23

Description The issue arises when Alpine silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH. This behavior is less secure than the alternative of closing the connection and letting the user decide what they would like to do.

Recommendations For versions prior to 2.23, update to version 2.23 or later to resolve the issue. As a temporary workaround, consider configuring Alpine to close the connection when an insecure connection is attempted after a /tls is sent, allowing the user to decide the next course of action.

Fix

Related Identifiers

CVE-2020-14929

DLA-2254-1

MGASA-2021-0014

OPENSUSE-SU-2021:0675-1

OPENSUSE-SU-2021:0695-1

OPENSUSE-SU-2021_0675-1

OPENSUSE-SU-2024:10613-1

USN-7360-1

Affected Products

Alpine

Linuxmint

Suse

Ubuntu

References · 28

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFXQGKZZMP3VSTLZVO5Z7Z6USYIW37A6 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2254-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14929 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2021:0695-1 · Vendor Advisory
• http://mailman13.u.washington.edu/pipermail/alpine-info/2020-June/008989.html · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2021:0675-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-14929 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0014 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14929 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0014.html · Security Note
• https://debian.org/lts/security/2020/dla-2254 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7360-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7360-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14929 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38370 · Vendor Advisory