PT-2021-22087 · Kde+2 · Kde Kmail+2

Damian Poddebniak · Published 2020-08-16 · Updated 2021-08-20 · CVE-2021-38373

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions KDE KMail version 19.12.3 (aka 5.13.3)

Description The SMTP STARTTLS option is not honored in KDE KMail, resulting in cleartext messages being sent unless the "Server requires authentication" option is checked.

Recommendations For KDE KMail version 19.12.3 (aka 5.13.3), ensure the "Server requires authentication" option is checked to enforce the use of STARTTLS for SMTP connections. As a temporary workaround, consider configuring the server to always require authentication for SMTP connections until a patch is available.

Fix

Cleartext Transmission of Sensitive Information

Command Injection

Weakness Enumeration

CWE-319

CWE-77

Related Identifiers

ALT-PU-2020-2597

CVE-2021-38373

Affected Products

Alt Linux

Debian

Kde Kmail

References · 12

• https://osv.dev/vulnerability/CVE-2021-38373 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38373 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-38373 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-38373 · Vendor Advisory
• https://bugs.kde.org/show_bug.cgi?id=423423 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-38373 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38373 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-38373 · Security Note
• https://nostarttls.secvuln.info · Note
• https://t.me/cvenotify/19004 · Telegram Post
• https://t.me/cibsecurity/27078 · Telegram Post
• https://kde.org/info/security/advisory-20211118-1.txt · Note