CVE-2007-1137: Medium severity Sourceforge Putmail vulnerability

Published Feb 27, 2007

Updated

putmail.py in Putmail before 1.4 does not detect when a user attempts to use TLS with a server that does not support it, which causes putmail.py to send the username and password in plaintext while the user believes encryption is in use, and allows remote attackers to obtain sensitive information.

Affected Software

9 affected components

Sourceforge Putmail=.8

Sourceforge Putmail=.10

Sourceforge Putmail=.9

Sourceforge Putmail=1.1

Sourceforge Putmail=.12

Sourceforge Putmail=1.2

Sourceforge Putmail=.11

Sourceforge Putmail=1.0

Sourceforge Putmail=1.3

Event History

Feb 27, 2007

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-1137?

CVE-2007-1137 is considered a medium severity vulnerability due to the potential exposure of sensitive information.

How do I fix CVE-2007-1137?

To fix CVE-2007-1137, upgrade Putmail to version 1.4 or later, where this issue is resolved.

What does CVE-2007-1137 exploit?

CVE-2007-1137 exploits a failure in putmail.py to detect whether TLS is supported by the server, leading to unencrypted transmission of credentials.

Which versions of Putmail are affected by CVE-2007-1137?

Versions of Putmail before 1.4, including 1.0 to 1.3 and 0.8 to 0.12, are affected by CVE-2007-1137.

What are the potential consequences of CVE-2007-1137?

The potential consequences of CVE-2007-1137 include unauthorized access to usernames and passwords by remote attackers.