CVE-2021-38373: Command Injection
Published Aug 10, 2021
·Updated
In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked.
Affected Software
1 affected component
KDE kmail=19.12.3
Event History
Aug 10, 2021
CVE Published
via MITRE·02:51 PM
Data Sourced
via MITRE·02:51 PM
Description
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-38373.
2
What is the title of this vulnerability?
The title of this vulnerability is "In KDE KMail 19.12.3 (aka 5.13.3) the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless 'Server requires authentication' is checked."
3
What is the severity rating of CVE-2021-38373?
The severity rating of CVE-2021-38373 is medium with a value of 5.3.
4
How does CVE-2021-38373 affect KDE KMail?
CVE-2021-38373 affects KDE KMail version 19.12.3 (aka 5.13.3).
5
How can I fix the vulnerability CVE-2021-38373?
To fix the vulnerability CVE-2021-38373, ensure that the "Server requires authentication" option is checked in KDE KMail settings.