PT-2020-6267 · Neomutt+9 · Neomutt+9
Damian Poddebniak
+1
·
Published
2020-11-23
·
Updated
2025-01-15
·
CVE-2020-28896
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Mutt versions prior to 2.0.2
NeoMutt versions prior to 2020-11-20
Description
The issue is related to insufficient protection of registration data, which could allow a remote attacker to access confidential data. If an IMAP server's initial server response was invalid, the connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.
Recommendations
For Mutt versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue.
For NeoMutt versions prior to 2020-11-20, update to a version released after 2020-11-20 to resolve the issue.
As a temporary workaround, consider disabling the use of IMAP servers with invalid initial server responses until a patch is available.
Restrict access to sensitive information to minimize the risk of exploitation.
Fix
Insufficiently Protected Credentials
Improper Authentication
Improper Handling of Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linuxmint
Mutt
Neomutt
Red Hat
Rocky Linux
Suse
Ubuntu