CVE-2024-49393: Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing
In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/neomuttto a version that resolves this vulnerability.Fixed in 20250404+dfsg-2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49393?
CVE-2024-49393 is rated as a medium severity vulnerability affecting neomutt and mutt.
How do I fix CVE-2024-49393?
To mitigate CVE-2024-49393, update neomutt to version 20250113+dfsg-1 or later version, and for mutt, ensure you're using a patched release.
What does CVE-2024-49393 affect?
CVE-2024-49393 affects neomutt and mutt email clients where the To and Cc email headers are not cryptographically validated.
What type of attack does CVE-2024-49393 enable?
CVE-2024-49393 enables an attacker to intercept and modify email headers, potentially compromising message confidentiality.
Can CVE-2024-49393 affect my email security?
Yes, if exploited, CVE-2024-49393 could allow unauthorized recipients to be added to emails, weakening overall email security.