Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."

The version of mutt installed on the remote host is prior to 1.5.21-29. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1892 advisory.

  - Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.
    (CVE-2020-14093)

  - Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the     user rejects an expired intermediate certificate. (CVE-2020-14154)

  - Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP,     and POP3. When a server sends a begin TLS response, the client reads additional data (e.g., from a man-     in-the-middle attacker) and evaluates it in a TLS context, aka response injection. (CVE-2020-14954)

  - Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an     IMAP server's initial server response was invalid. The connection was not properly closed, and the code     could continue attempting to authenticate. This could result in authentication credentials being exposed     on an unencrypted connection, or to a machine-in-the-middle. (CVE-2020-28896)

  - rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox     unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields     (aka terminators of empty groups). A small email message from the attacker can cause large memory     consumption, and the victim may then be unable to see email messages from other persons. (CVE-2021-3181)

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14414-1 advisory.

  - Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.
    (CVE-2020-14093)

  - Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the     user rejects an expired intermediate certificate. (CVE-2020-14154)

  - Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP,     and POP3. When a server sends a begin TLS response, the client reads additional data (e.g., from a man-     in-the-middle attacker) and evaluates it in a TLS context, aka response injection. (CVE-2020-14954)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the mutt package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Mutt before 1.14.3 proceeds with a connection even if,     in response to a GnuTLS certificate prompt, the user     rejects an expired intermediate     certificate.(CVE-2020-14154)

  - Mutt before 1.14.3 allows an IMAP fcc/postpone     man-in-the-middle attack via a PREAUTH     response.(CVE-2020-14093)

  - Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a     STARTTLS buffering issue that affects IMAP, SMTP, and     POP3. When a server sends a 'begin TLS' response, the     client reads additional data (e.g., from a     man-in-the-middle attacker) and evaluates it in a TLS     context, aka 'response injection.'(CVE-2020-14954)

  - Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not     ensure that $ssl_force_tls was processed if an IMAP     server's initial server response was invalid. The     connection was not properly closed, and the code could     continue attempting to authenticate. This could result     in authentication credentials being exposed on an     unencrypted connection, or to a     machine-in-the-middle.(CVE-2020-28896)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for neomutt fixes the following issues :

Update neomutt to 20201120. Address boo#1179035, CVE-2020-28896.

  - Security

  - imap: close connection on all failures

  - Features

  - alias: add function to Alias/Query dialogs

  - config: add validators for     (imap,smtp,pop)_authenticators

  - config: warn when signature file is missing or not     readable

  - smtp: support for native SMTP LOGIN auth mech

  - notmuch: show originating folder in index

  - Bug Fixes

  - sidebar: prevent the divider colour bleeding out

  - sidebar: fix <sidebar-(next,prev)-new>

  - notmuch: fix query for current email

  - restore shutdown-hook functionality

  - crash in reply-to

  - user-after-free in folder-hook

  - fix some leaks

  - fix application of limits to modified mailboxes

  - write Date header when postponing

  - Translations

  - 100% Lithuanian

  - 100% Czech

  - 70% Turkish

  - Docs

  - Document that $sort_alias affects the query menu

  - Build

  - improve ASAN flags

  - add SASL and S/MIME to --everything

  - fix contrib (un)install

  - Code

  - my_hdr compose screen notifications

  - add contracts to the MXAPI

  - maildir refactoring

  - further reduce the use of global variables

  - Upstream

  - Add $count_alternatives to count attachments inside     alternatives

  - Changes from 20200925

  - Features

  - Compose: display user-defined headers

  - Address Book / Query: live sorting

  - Address Book / Query: patterns for searching

  - Config: Add '+=' and '-=' operators for String Lists

  - Config: Add '+=' operator for Strings

  - Allow postfix query ':setenv NAME?' for env vars

  - Bug Fixes

  - Fix crash when searching with invalid regexes

  - Compose: Prevent infinite loop of send2-hooks

  - Fix sidebar on new/removed mailboxes

  - Restore indentation for named mailboxes

  - Prevent half-parsing an alias

  - Remove folder creation prompt for POP path

  - Show error if $message_cachedir doesn't point to a valid     directory

  - Fix tracking LastDir in case of IMAP paths with Unicode     characters

  - Make sure all mail gets applied the index limit

  - Add warnings to -Q query CLI option

  - Fix index tracking functionality

  - Changed Config

  - Add $compose_show_user_headers (yes)

  - Translations

  - 100% Czech

  - 100% Lithuanian

  - Split up usage strings

  - Build

  - Run shellcheck on hcachever.sh

  - Add the Address Sanitizer

  - Move compose files to lib under compose/

  - Move address config into libaddress

  - Update to latest acutest - fixes a memory leak in the     unit tests

  - Code

  - Implement ARRAY API

  - Deglobalised the Config Sort functions

  - Refactor the Sidebar to be Event-Driven

  - Refactor the Color Event

  - Refactor the Commands list

  - Make ctx_update_tables private

  - Reduce the scope/deps of some Validator functions

  - Use the Email's IMAP UID instead of an increasing number     as index

  - debug: log window focus

  - Removed     neomutt-sidebar-abbreviate-shorten-what-user-sees.patch.
    No longer needed.

  - Update to 20200821 :

  - Bug Fixes

  - fix maildir flag generation

  - fix query notmuch if file is missing

  - notmuch: don't abort sync on error

  - fix type checking for send config variables

  - Changed Config

  - $sidebar_format - Use %D rather than %B for named     mailboxes

  - Translations

  - 96% Lithuanian

  - 90% Polish

  - fix(sidebar): abbreviate/shorten what user sees

  - Fix sidebar mailbox name display problem. 

  - Update to 20200814 :

  - Notes

  - Add one-liner docs to config items See: neomutt -O -Q     smart_wrap

  - Remove the built-in editor A large unused and unusable     feature

  - Security

  - Add mitigation against DoS from thousands of parts     boo#1179113

  - Features

  - Allow index-style searching in postpone menu

  - Open NeoMutt using a mailbox name

  - Add cd command to change the current working directory

  - Add tab-completion menu for patterns

  - Allow renaming existing mailboxes

  - Check for missing attachments in alternative parts

  - Add one-liner docs to config items

  - Bug Fixes

  - Fix logic in checking an empty From address

  - Fix Imap crash in cmd_parse_expunge()

  - Fix setting attributes with S-Lang

  - Fix: redrawing of $pager_index_lines

  - Fix progress percentage for syncing large mboxes

  - Fix sidebar drawing in presence of indentation + named     mailboxes

  - Fix retrieval of drafts when 'postponed' is not in the     mailboxes list

  - Do not add comments to address group terminators

  - Fix alias sorting for degenerate addresses

  - Fix attaching emails

  - Create directories for nonexistent file hcache case

  - Avoid creating mailboxes for failed subscribes

  - Fix crash if rejecting cert

  - Changed Config

  - Add $copy_decode_weed, $pipe_decode_weed,     $print_decode_weed

  - Change default of $crypt_protected_headers_subject to     '...'

  - Add default keybindings to history-up/down

  - Translations

  - 100% Czech

  - 100% Spanish

  - Build

  - Allow building against Lua 5.4

  - Fix when sqlite3.h is missing

  - Docs

  - Add a brief section on stty to the manual

  - Update section 'Terminal Keybindings' in the manual

  - Clarify PGP Pseudo-header S<id> duration

  - Code

  - Clean up String API

  - Make the Sidebar more independent

  - De-centralise the Config Variables

  - Refactor dialogs

  - Refactor: Help Bar generation

  - Make more APIs Context-free

  - Adjust the edata use in Maildir and Notmuch

  - Window refactoring

  - Convert libsend to use Config functions

  - Refactor notifications to reduce noise

  - Convert Keymaps to use STAILQ

  - Track currently selected email by msgid

  - Config: no backing global variable

  - Add events for key binding

  - Upstream

  - Fix imap postponed mailbox use-after-free error

  - Speed up thread sort when many long threads exist

  - Fix ~v tagging when switching to non-threaded sorting

  - Add message/global to the list of known 'message' types

  - Print progress meter when copying/saving tagged messages

  - Remove ansi formatting from autoview generated quoted     replies

  - Change postpone mode to write Date header too

  - Unstuff format=flowed

  - Update to 20200626 :

  - Bug Fixes

  - Avoid opening the same hcache file twice

  - Re-open Mailbox after folder-hook

  - Fix the matching of the spoolfile Mailbox

  - Fix link-thread to link all tagged emails

  - Changed Config

  - Add $tunnel_is_secure config, defaulting to true

  - Upstream

  - Don't check IMAP PREAUTH encryption if $tunnel is in use

  - Add recommendation to use $ssl_force_tls

  - Changes from 20200501 :

  - Security

  - Abort GnuTLS certificate check if a cert in the chain is     rejected CVE-2020-14154 boo#1172906

  - TLS: clear data after a starttls acknowledgement     CVE-2020-14954 boo#1173197

  - Prevent possible IMAP MITM via PREAUTH response     CVE-2020-14093 boo#1172935

  - Features

  - add config operations +=/-= for number,long

  - Address book has a comment field

  - Query menu has a comment field

  - Contrib sample.neomuttrc-starter: Do not echo prompted     password

  - Bug Fixes

  - make 'news://' and 'nntp://' schemes interchangeable

  - Fix CRLF to LF conversion in base64 decoding

  - Double comma in query

  - compose: fix redraw after history

  - Crash inside empty query menu

  - mmdf: fix creating new mailbox

  - mh: fix creating new mailbox

  - mbox: error out when an mbox/mmdf is a pipe

  - Fix list-reply by correct parsing of List-Post headers

  - Decode references according to RFC2047

  - fix tagged message count

  - hcache: fix keylen not being considered when building     the full key

  - sidebar: fix path comparison

  - Don't mess with the original pattern when running IMAP     searches

  - Handle IMAP 'NO' resps by issuing a msg instead of     failing badly

  - imap: use the connection delimiter if provided

  - Memory leaks

  - Changed Config

  - $alias_format default changed to include %c comment

  - $query_format default changed to include %e extra info

  - Translations

  - 100% Lithuanian

  - 84% French

  - Log the translation in use

  - Docs

  - Add missing commands unbind, unmacro to man pages

  - Build

  - Check size of long using LONG_MAX instead of __WORDSIZE

  - Allow ./configure to not record cflags

  - fix out-of-tree build

  - Avoid locating gdbm symbols in qdbm library

  - Code

  - Refactor unsafe TAILQ returns

  - add window notifications

  - flip negative ifs

  - Update to latest acutest.h

  - test: add store tests

  - test: add compression tests

  - graphviz: email

  - make more opcode info available

  - refactor: main_change_folder()

  - refactor: mutt_mailbox_next()

  - refactor: generate_body()

  - compress: add (min,max)_level to ComprOps

  - emphasise empty loops: '// do nothing'

  - prex: convert is_from() to use regex

  - Refactor IMAP's search routines

  - Update to 20200501 :

  - Bug Fixes

  - Make sure buffers are initialized on error

  - fix(sidebar): use abbreviated path if possible

  - Translations

  - 100% Lithuanian

  - Docs

  - make header cache config more explicit

  - Changes from 20200424 :

  - Bug Fixes

  - Fix history corruption

  - Handle pretty much anything in a URL query part

  - Correctly parse escaped characters in header phrases

  - Fix crash reading received header

  - Fix sidebar indentation

  - Avoid crashing on failure to parse an IMAP mailbox

  - Maildir: handle deleted emails correctly

  - Ensure OP_NULL is always first

  - Translations

  - 100% Czech

  - Build

  - cirrus: enable pcre2, make pkgconf a special case

  - Fix finding pcre2 w/o pkgconf

  - build: tdb.h needs size_t, bring it in with stddef.h

  - Changes from 20200417 :

  - Features

  - Fluid layout for Compose Screen, see:
    vimeo.com/407231157

  - Trivial Database (TDB) header cache backend

  - RocksDB header cache backend

  - Add <sidebar-first> and <sidebar-last> functions

  - Bug Fixes

  - add error for CLI empty emails

  - Allow spaces and square brackets in paths

  - browser: fix hidden mailboxes

  - fix initial email display

  - notmuch: fix time window search.

  - fix resize bugs

  - notmuch: fix entire-thread: update current email pointer

  - sidebar: support indenting and shortening of names

  - Handle variables inside backticks in sidebar_whitelist

  - browser: fix mask regex error reporting

  - Translations

  - 100% Lithuanian

  - 99% Chinese (simplified)

  - Build

  - Use regexes for common parsing tasks: urls, dates

  - Add configure option --pcre2 -- Enable PCRE2 regular     expressions

  - Add configure option --tdb -- Use TDB for the header     cache

  - Add configure option --rocksdb -- Use RocksDB for the     header cache

  - Create libstore (key/value backends)

  - Update to latest autosetup

  - Update to latest acutest.h

  - Rename doc/ directory to docs/

  - make: fix location of .Po dependency files

  - Change libcompress to be more universal

  - Fix test fails on &#x445;32

  - fix uidvalidity to unsigned 32-bit int

  - Code

  - Increase test coverage

  - Fix memory leaks

  - Fix null checks

  - Upstream

  - Buffer refactoring

  - Fix use-after-free in mutt_str_replace()

  - Clarify PGP Pseudo-header S<id> duration

  - Try to respect MUTT_QUIET for IMAP contexts too

  - Limit recurse depth when parsing mime messages

  - Update to 20200320 :

  - Bug Fixes

  - Fix COLUMNS env var

  - Fix sync after delete

  - Fix crash in notmuch

  - Fix sidebar indent

  - Fix emptying trash

  - Fix command line sending

  - Fix reading large address lists

  - Resolve symlinks only when necessary

  - Translations

  - lithuania 100% Lithuanian

  - es 96% Spanish

  - Docs

  - Include OpenSSL/LibreSSL/GnuTLS version in neomutt -v     output

  - Fix case of GPGME and SQLite

  - Build

  - Create libcompress (lz4, zlib, zstd)

  - Create libhistory

  - Create libbcache

  - Move zstrm to libconn

  - Code

  - Add more test coverage

  - Rename magic to type

  - Use mutt_file_fopen() on config variables

  - Change commands to use intptr_t for data

  - Update to 20200313 :

  - Window layout

  - Sidebar is only visible when it's usable.

  - Features

  - UI: add number of old messages to sidebar_format

  - UI: support ISO 8601 calendar date

  - UI: fix commands that don&rsquo;t need to have a     non-empty mailbox to be valid

  - PGP: inform about successful decryption of inline PGP     messages

  - PGP: try to infer the signing key from the From address

  - PGP: enable GPGMe by default

  - Notmuch: use query as name for vfolder-from-query

  - IMAP: add network traffic compression (COMPRESS=DEFLATE,     RFC4978)

  - Header cache: add support for generic header cache     compression

  - Bug Fixes

  - Fix uncollapse_jump

  - Only try to perform entire-thread on maildir/mh     mailboxes

  - Fix crash in pager

  - Avoid logging single new lines at the end of header     fields

  - Fix listing mailboxes

  - Do not recurse a non-threaded message

  - Fix initial window order

  - Fix leaks on IMAP error paths

  - Notmuch: compose(attach-message): support notmuch     backend

  - Fix IMAP flag comparison code

  - Fix $move for IMAP mailboxes

  - Maildir: maildir_mbox_check_stats should only update     mailbox stats if requested

  - Fix unmailboxes for virtual mailboxes

  - Maildir: sanitize filename before hashing

  - OAuth: if 'login' name isn't available use 'user'

  - Add error message on failed encryption

  - Fix a bunch of crashes

  - Force C locale for email date

  - Abort if run without a terminal

  - Changed Config

  - $crypt_use_gpgme - Now defaults to 'yes' (enabled)

  - $abort_backspace - Hitting backspace against an empty     prompt aborts the prompt

  - $abort_key - String representation of key to abort     prompts

  - $arrow_string - Use an custom string for arrow_cursor

  - $crypt_opportunistic_encrypt_strong_keys - Enable     encryption only when strong a key is available

  - $header_cache_compress_dictionary - Filepath to     dictionary for zstd compression

  - $header_cache_compress_level - Level of compression for     method

  - $header_cache_compress_method - Enable generic hcache     database compression

  - $imap_deflate - Compress network traffic

  - $smtp_user - Username for the SMTP server

  - Translations

  - 100% Lithuanian

  - 81% Spanish

  - 78% Russian

  - Build

  - Add libdebug

  - Rename public headers to lib.h

  - Create libcompress for compressed folders code

  - Code

  - Refactor Windows and Dialogs

  - Lots of code tidying

  - Refactor: mutt_addrlist_(search,write)

  - Lots of improvements to the Config code

  - Use Buffers more pervasively

  - Unify API function naming

  - Rename library shared headers

  - Refactor libconn gui dependencies

  - Refactor: init.[ch]

  - Refactor config to use subsets

  - Config: add path type

  - Remove backend deps from the connection code

  - Upstream

  - Allow ~b ~B ~h patterns in send2-hook

  - Rename smime oppenc mode parameter to get_keys_by_addr()

  - Add $crypt_opportunistic_encrypt_strong_keys config var

  - Fix crash when polling a closed ssl connection

  - Turn off auto-clear outside of autocrypt initialization

  - Add protected-headers='v1' to Content-Type when     protecting headers

  - Fix segv in IMAP postponed menu caused by reopen_allow

  - Adding ISO 8601 calendar date

  - Fix $fcc_attach to not prompt in batch mode

  - Convert remaining mutt_encode_path() call to use struct     Buffer

  - Fix rendering of replacement_char when Charset_is_utf8

  - Update to latest acutest.h

  - Update to 20191207 :

  - Features :

  - compose: draw status bar with highlights

  - Bug Fixes :

  - crash opening notmuch mailbox

  - crash in mutt_autocrypt_ui_recommendation

  - Avoid negative allocation

  - Mbox new mail

  - Setting of DT_MAILBOX type variables from Lua

  - imap: empty cmdbuf before connecting

  - imap: select the mailbox on reconnect

  - compose: fix attach message

  - Build :

  - make files conditional

  - Code :

  - enum-ify log levels

  - fix function prototypes

  - refactor virtual email lookups

  - factor out global Context

  - Changes from 20191129 :

  - Features :

  - Add raw mailsize expando (%cr)

  - Bug Fixes :

  - Avoid double question marks in bounce confirmation msg

  - Fix bounce confirmation

  - fix new-mail flags and behaviour

  - fix: browser <descend-directory>

  - fix ssl crash

  - fix move to trash

  - fix flickering

  - Do not check hidden mailboxes for new mail

  - Fix new_mail_command notifications

  - fix crash in examine_mailboxes()

  - fix crash in mutt_sort_threads()

  - fix: crash after sending

  - Fix crash in tunnel's conn_close

  - fix fcc for deep dirs

  - imap: fix crash when new mail arrives

  - fix colour 'quoted9'

  - quieten messages on exit

  - fix: crash after failed mbox_check

  - browser: default to a file/dir view when attaching a     file

  - Changed Config :

  - Change $write_bcc to default off

  - Docs :

  - Add a bit more documentation about sending

  - Clarify $write_bcc documentation.

  - Update documentation for raw size expando

  - docbook: set generate.consistent.ids to make generated     html reproducible

  - Build :

  - fix build/tests for 32-bit arches

  - tests: fix test that would fail soon

  - tests: fix context for failing idna tests

  - Update to 20191111: Bug fixes :

  - browser: fix directory view

  - fix crash in mutt_extract_token()

  - force a screen refresh

  - fix crash sending message from command line

  - notmuch: use nm_default_uri if no mailbox data

  - fix forward attachments

  - fix: vfprintf undefined behaviour in body_handler

  - Fix relative symlink resolution

  - fix: trash to non-existent file/dir

  - fix re-opening of mbox Mailboxes

  - close logging as late as possible

  - log unknown mailboxes

  - fix crash in command line postpone

  - fix memory leaks

  - fix icommand parsing

  - fix new mail interaction with mail_check_recent

According to the versions of the mutt package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Mutt before 1.14.3 allows an IMAP fcc/postpone     man-in-the-middle attack via a PREAUTH     response.(CVE-2020-14093)

  - Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a     STARTTLS buffering issue that affects IMAP, SMTP, and     POP3. When a server sends a 'begin TLS' response, the     client reads additional data (e.g., from a     man-in-the-middle attacker) and evaluates it in a TLS     context, aka 'response injection.'(CVE-2020-14954)

  - Mutt before 1.14.3 proceeds with a connection even if,     in response to a GnuTLS certificate prompt, the user     rejects an expired intermediate     certificate.(CVE-2020-14154)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202007-57 (Mutt, Neomutt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mutt and Neomutt.
      Please review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for mutt fixes the following issues :

  - CVE-2020-14954: Fixed a response injection due to a     STARTTLS buffering issue which was affecting IMAP, SMTP,     and POP3 (bsc#1173197).

  - CVE-2020-14093: Fixed a potential IMAP Man-in-the-Middle     attack via a PREAUTH response (bsc#1172906,     bsc#1172935).

  - CVE-2020-14154: Fixed an issue where Mutt was ignoring     an expired certificate and was proceeding with a     connection (bsc#1172906, bsc#1172935). 

This update was imported from the SUSE:SLE-15:Update update project.

This update for mutt fixes the following issues :

CVE-2020-14954: Fixed a response injection due to a STARTTLS buffering issue which was affecting IMAP, SMTP, and POP3 (bsc#1173197).

CVE-2020-14093: Fixed a potential IMAP Man-in-the-Middle attack via a PREAUTH response (bsc#1172906, bsc#1172935).

CVE-2020-14154: Fixed an issue where Mutt was ignoring an expired certificate and was proceeding with a connection (bsc#1172906, bsc#1172935).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2020-14954

----

Minor update

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2020-14954

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities have been discovered in mutt, a console email client.

CVE-2020-14093

Mutt allowed an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.

CVE-2020-14954

Mutt had a STARTTLS buffering issue that affected IMAP, SMTP, and POP3. When a server had sent a 'begin TLS' response, the client read additional data (e.g., from a man-in-the-middle attacker) and evaluated it in a TLS context, aka 'response injection.'

In Debian jessie, the mutt source package builds two variants of mutt:
mutt and mutt-patched.

The previous package version (1.5.23-3+deb8u2, DLA-2268-1) provided fixes for the issues referenced above, but they were only applied for the mutt-patched package build, not for the (vanilla) mutt package build.

For Debian 8 'Jessie', this problem has been fixed in version 1.5.23-3+deb8u3.

We recommend that you upgrade your mutt packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Mutt incorrectly handled certain requests. An attacker could possibly use this issue to enable MITM attacks.
(CVE-2020-14954) This update also address a regression caused in the last update USN-4401-1. It only affected Ubuntu 12.04 ESM, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 19.10.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

mutt 1.14.4 updates :

CVE-2020-14954 - Machine-in-the-middle response injection attack when using STARTTLS with IMAP, POP3, and SMTP

Damian Poddebniak and Fabian Ising discovered two security issues in the STARTTLS handling of the Neomutt mail client, which could enable MITM attacks.

Damian Poddebniak and Fabian Ising discovered two security issues in the STARTTLS handling of the Mutt mail client, which could enable MITM attacks.

ID	Name	Product	Family	Severity
168438	Amazon Linux 2 : mutt (ALAS-2022-1892)	Nessus	Amazon Linux Local Security Checks	medium
150520	SUSE SLES11 Security Update : mutt (SUSE-SU-2020:14414-1)	Nessus	SuSE Local Security Checks	medium
146703	EulerOS 2.0 SP2 : mutt (EulerOS-SA-2021-1330)	Nessus	Huawei Local Security Checks	medium
143462	openSUSE Security Update : neomutt (openSUSE-2020-2127)	Nessus	SuSE Local Security Checks	medium
142070	EulerOS 2.0 SP5 : mutt (EulerOS-SA-2020-2258)	Nessus	Huawei Local Security Checks	medium
140876	EulerOS 2.0 SP3 : mutt (EulerOS-SA-2020-2109)	Nessus	Huawei Local Security Checks	medium
139120	GLSA-202007-57 : Mutt, Neomutt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
138721	openSUSE Security Update : mutt (openSUSE-2020-915)	Nessus	SuSE Local Security Checks	medium
138713	openSUSE Security Update : mutt (openSUSE-2020-903)	Nessus	SuSE Local Security Checks	medium
138307	SUSE SLES12 Security Update : mutt (SUSE-SU-2020:1794-1)	Nessus	SuSE Local Security Checks	medium
138301	SUSE SLED15 / SLES15 Security Update : mutt (SUSE-SU-2020:1771-1)	Nessus	SuSE Local Security Checks	medium
138110	Fedora 31 : 5:mutt (2020-31af2ac7fd)	Nessus	Fedora Local Security Checks	medium
138108	Fedora 32 : 5:mutt (2020-1cb4c3697b)	Nessus	Fedora Local Security Checks	medium
137911	Debian DLA-2268-2 : mutt regression update	Nessus	Debian Local Security Checks	medium
137825	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Mutt vulnerability and regression (USN-4403-1)	Nessus	Ubuntu Local Security Checks	medium
137789	FreeBSD : Machine-in-the-middle response injection attack when using STARTTLS with IMAP, POP3, and SMTP (29b13a34-b1d2-11ea-a11c-4437e6ad11c4)	Nessus	FreeBSD Local Security Checks	medium
137731	Debian DSA-4708-1 : neomutt - security update	Nessus	Debian Local Security Checks	medium
137675	Debian DSA-4707-1 : mutt - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-14954

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium