PT-2020-14143 · Kde · Trojita

Damian Poddebniak · Published 2020-06-25 · Updated 2021-02-15 · CVE-2020-15047

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trojita versions prior to 0.8

Description The issue allows man-in-the-middle attackers to spoof SMTP servers by ignoring certificate-verification errors in the MSA/SMTP.cpp component.

Recommendations For versions prior to 0.8, update to version 0.8 or later to resolve the issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-15047

MGASA-2021-0082

Affected Products

Trojita

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2020-15047 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-15047 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0082.html · Security Note
• https://bugs.kde.org/show_bug.cgi?id=423453 · Patch
• https://ubuntu.com/security/CVE-2020-15047 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15047 · Vendor Advisory
• https://gerrit.vesnicky.cesnet.cz/r/1035 · Patch
• https://cve.org/CVERecord?id=CVE-2020-15047 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0082 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15047 · Note
• https://openwall.com/lists/oss-security/2020/06/25/1 · Note
• https://bugs.mageia.org/show_bug.cgi?id=26859 · Note
• https://gerrit.vesnicky.cesnet.cz/r/#/c/1035 · Note
• https://t.me/cvenotify/4641 · Telegram Post