CVE-2014-7274
The IMAP-over-SSL implementation in getmail 4.44.0 does not verify that the server hostname...
The IMAP-over-SSL implementation in getmail 4.44.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IMAP servers and obtain sensitive information via a crafted certificate from a recognized Certification Authority.
Exploit likelihood
What each source reports
NVD Score used
The IMAP-over-SSL implementation in getmail 4.44.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IMAP servers and obtain sensitive information via a crafted certificate from a recognized Certification Authority.
- Record
CVE-2014-7274- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
The IMAP-over-SSL implementation in getmail 4.44.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IMAP servers and obtain sensitive information via a crafted certificate from a recognized Certification Authority.
- Record
CVE-2014-7274- Updated
- 2026-11-02
EUVDEUVD-2014-7145 No score
The IMAP-over-SSL implementation in getmail 4.44.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IMAP servers and obtain sensitive information via a crafted certificate from a recognized Certification Authority.
- Record
EUVD-2014-7145- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gc28-p757-69vv No score
The IMAP-over-SSL implementation in getmail 4.44.0 does not verify that the server hostname...
The IMAP-over-SSL implementation in getmail 4.44.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IMAP servers and obtain sensitive information via a crafted certificate from a recognized Certification Authority.
- Record
GHSA-gc28-p757-69vv- Updated
- 2026-11-02
OSVMGASA-2014-0450 No score
Updated getmail package fixes security vulnerabilities
The IMAP-over-SSL implementation in getmail 4.0.0 through 4.43.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof IMAP servers and obtain sensitive information via a crafted certificate (CVE-2014-7273).
The IMAP-over-SSL implementation in getmail 4.44.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IMAP servers and obtain sensitive information via a crafted certificate from a recognized Certification Authority (CVE-2014-7274).
The POP3-over-SSL implementation in getmail 4.0.0 through 4.44.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof POP3 servers and obtain sensitive information via a crafted certificate (CVE-2014-7275).
- Record
MGASA-2014-0450- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10525-1 No score
getmail-4.46.0-1.2 on GA media
These are all security issues fixed in the getmail-4.46.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10525-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
getmail4Debian:6.0 |
before 4.46.0-1~deb6u1, plus listed versions 4.20.0-14.20.2-14.20.3-14.20.3-24.20.4-1 Show 22 moreShow less4.22.1-14.22.2-14.23.0-14.23.0-24.24.0-14.26.0-14.27.0-14.27.0-1~bpo60+14.29.0-14.29.0-24.30.0-14.30.1-14.30.2-14.32.0-14.32.0-24.40.3-14.40.3-24.40.3-34.41.0-14.41.0-24.43.0-14.44.0-1 |
4.46.0-1~deb6u1 |
getmail4Debian:7 |
before 4.46.0-1~deb7u1, plus listed versions 4.32.0-24.40.3-14.40.3-24.40.3-34.41.0-1 Show 4 moreShow less4.41.0-24.43.0-14.44.0-14.46.0-1~deb6u1 |
4.46.0-1~deb7u1 |
getmailMageia:3 |
before 4.46.0-1.mga3 | 4.46.0-1.mga3 |
getmailMageia:4 |
before 4.46.0-1.mga4 | 4.46.0-1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-7274 is a medium vulnerability (CVSS 5.8) in Getmail, published October 8, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 57th percentile. Fixed in getmail4 4.46.0-1~deb6u1.