CVE-2020-28896: Medium severity Mutt Mutt vulnerability
Last updated 16 January 2025
Other sources
Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $sslforcetls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/muttto a version that resolves this vulnerability.Fixed in 2.0.5-4.1+deb11u3Fixed in 2.2.12-0.1~deb12u1Fixed in 2.2.9-1+deb12u1Fixed in 2.2.13-1 - Upgrade
Upgrade
debian/neomuttto a version that resolves this vulnerability.Fixed in 20201127+dfsg.1-1.2Fixed in 20220429+dfsg1-4.1Fixed in 20250404+dfsg-2 - Upgrade
Upgrade
alpine/muttto a version that resolves this vulnerability.Fixed in 2.0.2-r0 - Upgrade
Upgrade
Muttto a version that resolves this vulnerability.Fixed in 2.0.2 - Upgrade
Upgrade
NeoMuttto a version that resolves this vulnerability.Fixed in 2020-11-20
Event History
Frequently Asked Questions
What is CVE-2020-28896?
CVE-2020-28896 is a vulnerability in Mutt and NeoMutt that allowed an IMAP server's initial server response to be processed even if $ssl_force_tls was invalid, potentially allowing authentication credentials to be exposed.
How severe is CVE-2020-28896?
CVE-2020-28896 has a severity score of 5.3, which is considered medium.
Which software versions are affected by CVE-2020-28896?
Mutt versions before 2.0.2 and NeoMutt versions before 2020-11-20 are affected by CVE-2020-28896.
How can I fix CVE-2020-28896?
To fix CVE-2020-28896, you should update to Mutt 2.0.2 or later versions, or NeoMutt 2020-11-20 or later versions.
What are the references for CVE-2020-28896?
The references for CVE-2020-28896 are: [Reference 1](https://github.com/neomutt/neomutt/commit/9c36717a3e2af1f2c1b7242035455ec8112b4b06), [Reference 2](https://github.com/neomutt/neomutt/releases/tag/20201120), [Reference 3](https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59a).