CVE-2018-14354: OS Command Injection
A flaw was found in mutt before 1.10.1. When "subscribing" to an IMAP mailbox, either via $imapchecksubscribed, or via the <subscribe> function in the browser menu, the lack of proper input parsing may lead to remote code injection from a malicous IMAP server.
Upstream patch:
References:
http://www.mutt.org/news.html https://gitlab.com/muttmua/mutt/blob/master/ChangeLog
Other sources
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-14354.
What is the severity of CVE-2018-14354?
The severity of CVE-2018-14354 is critical with a CVSS score of 9.8.
What is the affected software for CVE-2018-14354?
The affected software for CVE-2018-14354 includes Mutt versions before 1.10.1 and NeoMutt versions before 2018-07-16.
How does CVE-2018-14354 allow remote IMAP servers to execute arbitrary commands?
CVE-2018-14354 allows remote IMAP servers to execute arbitrary commands through the use of backquote characters in the mailboxes command associated with a manual subscription or unsubscription.
How can I fix CVE-2018-14354?
To fix CVE-2018-14354, you should update to the latest versions of Mutt and NeoMutt that contain the necessary security patches.