PT-2021-9848 · S/Qmail · S/Qmail

Published 2021-08-17 · Updated 2021-08-31 · CVE-2020-15955

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions s/qmail versions prior to 4.0.08

Description The issue allows an active Man-in-the-Middle (MitM) to inject arbitrary plaintext commands into a STARTTLS encrypted session between an SMTP client and s/qmail. This enables the attacker to intercept e-mail messages and user credentials.

Recommendations For versions prior to 4.0.08, update to version 4.0.08 or later to resolve the issue.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2020-15955

Affected Products

S/Qmail

References · 4

• https://osv.dev/vulnerability/CVE-2020-15955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15955 · Security Note
• https://fehcom.de/sqmail/sqmail.html · Vendor Advisory
• https://nostarttls.secvuln.info · Note