CVE-2020-28896
First published: Mon Nov 23 2020(Updated: )
Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mutt Mutt | <2.0.2 | |
| Neomutt Neomutt | <2020-11-20 | |
| Debian Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/neomutt/neomutt/commit/9c36717a3e2af1f2c1b7242035455ec8112b4b06
- https://github.com/neomutt/neomutt/releases/tag/20201120
- https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59a
- https://gitlab.com/muttmua/mutt/-/commit/d92689088dfe80a290ec836e292376e2d9984f8f
- https://lists.debian.org/debian-lts-announce/2020/11/msg00048.html
- https://security.gentoo.org/glsa/202101-32
Frequently Asked Questions
What is CVE-2020-28896?
CVE-2020-28896 is a vulnerability in Mutt and NeoMutt that allowed an IMAP server's initial server response to be processed even if $ssl_force_tls was invalid, potentially allowing authentication credentials to be exposed.
How severe is CVE-2020-28896?
CVE-2020-28896 has a severity score of 5.3, which is considered medium.
Which software versions are affected by CVE-2020-28896?
Mutt versions before 2.0.2 and NeoMutt versions before 2020-11-20 are affected by CVE-2020-28896.
How can I fix CVE-2020-28896?
To fix CVE-2020-28896, you should update to Mutt 2.0.2 or later versions, or NeoMutt 2020-11-20 or later versions.
What are the references for CVE-2020-28896?
The references for CVE-2020-28896 are: [Reference 1](https://github.com/neomutt/neomutt/commit/9c36717a3e2af1f2c1b7242035455ec8112b4b06), [Reference 2](https://github.com/neomutt/neomutt/releases/tag/20201120), [Reference 3](https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59a).
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/description
- agent/event
- agent/remedy
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- vendor/mutt
- canonical/mutt mutt
- vendor/neomutt
- canonical/neomutt neomutt
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0