CVE-2020-15953
First published: Mon Jul 27 2020(Updated: )
LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Libetpan Project Libetpan | <=1.9.4 | |
| <=0.6.3 | ||
| Fedoraproject Fedora | =31 | |
| Fedoraproject Fedora | =32 | |
| Debian Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00060.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00075.html
- https://github.com/dinhvh/libetpan/issues/386
- https://lists.debian.org/debian-lts-announce/2020/08/msg00026.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M65FVH5XPS23NLHFN3ABEGBSCHZAISXN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QFBWNA5REI5ZGW2DAOEAVHM23MOU6O5J/
- https://security.gentoo.org/glsa/202007-55
Frequently Asked Questions
What is CVE-2020-15953?
CVE-2020-15953 is a vulnerability in LibEtPan that affects IMAP, SMTP, and POP3 protocols due to a STARTTLS buffering issue.
What is the severity of CVE-2020-15953?
CVE-2020-15953 has a severity rating of 7.4 (High).
Which software products are affected by CVE-2020-15953?
CVE-2020-15953 affects LibEtPan versions up to and including 1.9.4, MailCore 2 versions up to and including 0.6.3, Fedora versions 31 and 32, and Debian Linux version 9.0.
How does CVE-2020-15953 impact the affected software?
CVE-2020-15953 allows a meddler-in-the-middle attacker to send additional data to the client, presenting a security risk for the IMAP, SMTP, and POP3 protocols.
Is there a fix available for CVE-2020-15953?
Yes, it is recommended to update to a version of LibEtPan or MailCore 2 that is not affected by the vulnerability.
- collector/nvd-index
- vendor/libetpan project
- canonical/libetpan project libetpan
- version/libetpan project libetpan/1.9.4
- vendor/libmailcore
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/31
- version/fedoraproject fedora/32
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0