CVE-2020-28896: Medium severity mutt vulnerability
Last updated 16 January 2025
Other sources
Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $sslforcetls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-28896?
CVE-2020-28896 is a vulnerability in Mutt and NeoMutt that allowed an IMAP server's initial server response to be processed even if $ssl_force_tls was invalid, potentially allowing authentication credentials to be exposed.
How severe is CVE-2020-28896?
CVE-2020-28896 has a severity score of 5.3, which is considered medium.
Which software versions are affected by CVE-2020-28896?
Mutt versions before 2.0.2 and NeoMutt versions before 2020-11-20 are affected by CVE-2020-28896.
How can I fix CVE-2020-28896?
To fix CVE-2020-28896, you should update to Mutt 2.0.2 or later versions, or NeoMutt 2020-11-20 or later versions.
What are the references for CVE-2020-28896?
The references for CVE-2020-28896 are: [Reference 1](https://github.com/neomutt/neomutt/commit/9c36717a3e2af1f2c1b7242035455ec8112b4b06), [Reference 2](https://github.com/neomutt/neomutt/releases/tag/20201120), [Reference 3](https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59a).