CVE-2020-14954

Mutt is a small but very powerful text-based mail client for Unix operating systems.

Security Fix(es):

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."(CVE-2020-14954)

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."

A potential IMAP Man-in-the-Middle attack via a PREAUTH response (CVE-2020-14093).

Mutt was ignoring an expired certificate and was proceeding with a connection (CVE-2020-14154).

A response injection due to a STARTTLS buffering issue which was affecting IMAP, SMTP, and POP3 (CVE-2020-14954).

This update for mutt fixes the following issues:

• CVE-2020-14954: Fixed a response injection due to a STARTTLS buffering issue which was affecting IMAP, SMTP, and POP3 (bsc#1173197).
• CVE-2020-14093: Fixed a potential IMAP Man-in-the-Middle attack via a PREAUTH response (bsc#1172906, bsc#1172935).
• CVE-2020-14154: Fixed an issue where Mutt was ignoring an expired certificate and was proceeding with a connection (bsc#1172906, bsc#1172935).

This update was imported from the SUSE:SLE-15:Update update project.

This update for mutt fixes the following issues:

• CVE-2020-14954: Fixed a response injection due to a STARTTLS buffering issue which was affecting IMAP, SMTP, and POP3 (bsc#1173197).
• CVE-2020-14093: Fixed a potential IMAP Man-in-the-Middle attack via a PREAUTH response (bsc#1172906, bsc#1172935).
• CVE-2020-14154: Fixed an issue where Mutt was ignoring an expired certificate and was proceeding with a connection (bsc#1172906, bsc#1172935).

This update was imported from the SUSE:SLE-15:Update update project.

This update for neomutt fixes the following issues:

Update neomutt to 20201120. Address boo#1179035, CVE-2020-28896.

• Security
  • imap: close connection on all failures
• Features
  • alias: add function to Alias/Query dialogs
  • config: add validators for {imap,smtp,pop}_authenticators
  • config: warn when signature file is missing or not readable
  • smtp: support for native SMTP LOGIN auth mech
  • notmuch: show originating folder in index
• Bug Fixes
  • sidebar: prevent the divider colour bleeding out
  • sidebar: fix <sidebar-{next,prev}-new>
  • notmuch: fix query for current email
  • restore shutdown-hook functionality
  • crash in reply-to
  • user-after-free in folder-hook
  • fix some leaks
  • fix application of limits to modified mailboxes
  • write Date header when postponing
• Translations
  • 100% Lithuanian
  • 100% Czech
  • 70% Turkish
• Docs
  • Document that $sort_alias affects the query menu
• Build
  • improve ASAN flags
  • add SASL and S/MIME to --everything
  • fix contrib (un)install
• Code
  • my_hdr compose screen notifications
  • add contracts to the MXAPI
  • maildir refactoring
  • further reduce the use of global variables
• Upstream
  • Add $count_alternatives to count attachments inside alternatives

• Changes from 20200925

  • Features
    • Compose: display user-defined headers
    • Address Book / Query: live sorting
    • Address Book / Query: patterns for searching
    • Config: Add '+=' and '-=' operators for String Lists
    • Config: Add '+=' operator for Strings
    • Allow postfix query ':setenv NAME?' for env vars
  • Bug Fixes
    • Fix crash when searching with invalid regexes
    • Compose: Prevent infinite loop of send2-hooks
    • Fix sidebar on new/removed mailboxes
    • Restore indentation for named mailboxes
    • Prevent half-parsing an alias
    • Remove folder creation prompt for POP path
    • Show error if $message_cachedir doesn't point to a valid directory
    • Fix tracking LastDir in case of IMAP paths with Unicode characters
    • Make sure all mail gets applied the index limit
    • Add warnings to -Q query CLI option
    • Fix index tracking functionality
  • Changed Config
    • Add $compose_show_user_headers (yes)
  • Translations
    • 100% Czech
    • 100% Lithuanian
    • Split up usage strings
  • Build
    • Run shellcheck on hcachever.sh
    • Add the Address Sanitizer
    • Move compose files to lib under compose/
    • Move address config into libaddress
    • Update to latest acutest - fixes a memory leak in the unit tests
  • Code
    • Implement ARRAY API
    • Deglobalised the Config Sort functions
    • Refactor the Sidebar to be Event-Driven
    • Refactor the Color Event
    • Refactor the Commands list
    • Make ctx_update_tables private
    • Reduce the scope/deps of some Validator functions
    • Use the Email's IMAP UID instead of an increasing number as index
    • debug: log window focus

• Removed neomutt-sidebar-abbreviate-shorten-what-user-sees.patch. No longer needed.

• Update to 20200821:

  • Bug Fixes
    • fix maildir flag generation
    • fix query notmuch if file is missing
    • notmuch: don't abort sync on error
    • fix type checking for send config variables
  • Changed Config
    • $sidebar_format - Use %D rather than %B for named mailboxes
  • Translations
    • 96% Lithuanian
    • 90% Polish

• fix(sidebar): abbreviate/shorten what user sees

• Fix sidebar mailbox name display problem.

• Update to 20200814:

  • Notes
    • Add one-liner docs to config items See: neomutt -O -Q smart_wrap
    • Remove the built-in editor A large unused and unusable feature
  • Security
    • Add mitigation against DoS from thousands of parts boo#1179113
  • Features
    • Allow index-style searching in postpone menu
    • Open NeoMutt using a mailbox name
    • Add cd command to change the current working directory
    • Add tab-completion…

This update for neomutt fixes the following issues:

Update neomutt to 20201120. Address boo#1179035, CVE-2020-28896.

• Security
  • imap: close connection on all failures
• Features
  • alias: add function to Alias/Query dialogs
  • config: add validators for {imap,smtp,pop}_authenticators
  • config: warn when signature file is missing or not readable
  • smtp: support for native SMTP LOGIN auth mech
  • notmuch: show originating folder in index
• Bug Fixes
  • sidebar: prevent the divider colour bleeding out
  • sidebar: fix <sidebar-{next,prev}-new>
  • notmuch: fix query for current email
  • restore shutdown-hook functionality
  • crash in reply-to
  • user-after-free in folder-hook
  • fix some leaks
  • fix application of limits to modified mailboxes
  • write Date header when postponing
• Translations
  • 100% Lithuanian
  • 100% Czech
  • 70% Turkish
• Docs
  • Document that $sort_alias affects the query menu
• Build
  • improve ASAN flags
  • add SASL and S/MIME to --everything
  • fix contrib (un)install
• Code
  • my_hdr compose screen notifications
  • add contracts to the MXAPI
  • maildir refactoring
  • further reduce the use of global variables
• Upstream
  • Add $count_alternatives to count attachments inside alternatives

• Changes from 20200925

  • Features
    • Compose: display user-defined headers
    • Address Book / Query: live sorting
    • Address Book / Query: patterns for searching
    • Config: Add '+=' and '-=' operators for String Lists
    • Config: Add '+=' operator for Strings
    • Allow postfix query ':setenv NAME?' for env vars
  • Bug Fixes
    • Fix crash when searching with invalid regexes
    • Compose: Prevent infinite loop of send2-hooks
    • Fix sidebar on new/removed mailboxes
    • Restore indentation for named mailboxes
    • Prevent half-parsing an alias
    • Remove folder creation prompt for POP path
    • Show error if $message_cachedir doesn't point to a valid directory
    • Fix tracking LastDir in case of IMAP paths with Unicode characters
    • Make sure all mail gets applied the index limit
    • Add warnings to -Q query CLI option
    • Fix index tracking functionality
  • Changed Config
    • Add $compose_show_user_headers (yes)
  • Translations
    • 100% Czech
    • 100% Lithuanian
    • Split up usage strings
  • Build
    • Run shellcheck on hcachever.sh
    • Add the Address Sanitizer
    • Move compose files to lib under compose/
    • Move address config into libaddress
    • Update to latest acutest - fixes a memory leak in the unit tests
  • Code
    • Implement ARRAY API
    • Deglobalised the Config Sort functions
    • Refactor the Sidebar to be Event-Driven
    • Refactor the Color Event
    • Refactor the Commands list
    • Make ctx_update_tables private
    • Reduce the scope/deps of some Validator functions
    • Use the Email's IMAP UID instead of an increasing number as index
    • debug: log window focus

• Removed neomutt-sidebar-abbreviate-shorten-what-user-sees.patch. No longer needed.

• Update to 20200821:

  • Bug Fixes
    • fix maildir flag generation
    • fix query notmuch if file is missing
    • notmuch: don't abort sync on error
    • fix type checking for send config variables
  • Changed Config
    • $sidebar_format - Use %D rather than %B for named mailboxes
  • Translations
    • 96% Lithuanian
    • 90% Polish

• fix(sidebar): abbreviate/shorten what user sees

• Fix sidebar mailbox name display problem.

• Update to 20200814:

  • Notes
    • Add one-liner docs to config items See: neomutt -O -Q smart_wrap
    • Remove the built-in editor A large unused and unusable feature
  • Security
    • Add mitigation against DoS from thousands of parts boo#1179113
  • Features
    • Allow index-style searching in postpone menu
    • Open NeoMutt using a mailbox name
    • Add cd command to change the current working directory
    • Add tab-completion…

This update for neomutt fixes the following issues:

Update neomutt to 20201120. Address boo#1179035, CVE-2020-28896.

• Security
  • imap: close connection on all failures
• Features
  • alias: add function to Alias/Query dialogs
  • config: add validators for {imap,smtp,pop}_authenticators
  • config: warn when signature file is missing or not readable
  • smtp: support for native SMTP LOGIN auth mech
  • notmuch: show originating folder in index
• Bug Fixes
  • sidebar: prevent the divider colour bleeding out
  • sidebar: fix <sidebar-{next,prev}-new>
  • notmuch: fix query for current email
  • restore shutdown-hook functionality
  • crash in reply-to
  • user-after-free in folder-hook
  • fix some leaks
  • fix application of limits to modified mailboxes
  • write Date header when postponing
• Translations
  • 100% Lithuanian
  • 100% Czech
  • 70% Turkish
• Docs
  • Document that $sort_alias affects the query menu
• Build
  • improve ASAN flags
  • add SASL and S/MIME to --everything
  • fix contrib (un)install
• Code
  • my_hdr compose screen notifications
  • add contracts to the MXAPI
  • maildir refactoring
  • further reduce the use of global variables
• Upstream
  • Add $count_alternatives to count attachments inside alternatives

• Changes from 20200925

  • Features
    • Compose: display user-defined headers
    • Address Book / Query: live sorting
    • Address Book / Query: patterns for searching
    • Config: Add '+=' and '-=' operators for String Lists
    • Config: Add '+=' operator for Strings
    • Allow postfix query ':setenv NAME?' for env vars
  • Bug Fixes
    • Fix crash when searching with invalid regexes
    • Compose: Prevent infinite loop of send2-hooks
    • Fix sidebar on new/removed mailboxes
    • Restore indentation for named mailboxes
    • Prevent half-parsing an alias
    • Remove folder creation prompt for POP path
    • Show error if $message_cachedir doesn't point to a valid directory
    • Fix tracking LastDir in case of IMAP paths with Unicode characters
    • Make sure all mail gets applied the index limit
    • Add warnings to -Q query CLI option
    • Fix index tracking functionality
  • Changed Config
    • Add $compose_show_user_headers (yes)
  • Translations
    • 100% Czech
    • 100% Lithuanian
    • Split up usage strings
  • Build
    • Run shellcheck on hcachever.sh
    • Add the Address Sanitizer
    • Move compose files to lib under compose/
    • Move address config into libaddress
    • Update to latest acutest - fixes a memory leak in the unit tests
  • Code
    • Implement ARRAY API
    • Deglobalised the Config Sort functions
    • Refactor the Sidebar to be Event-Driven
    • Refactor the Color Event
    • Refactor the Commands list
    • Make ctx_update_tables private
    • Reduce the scope/deps of some Validator functions
    • Use the Email's IMAP UID instead of an increasing number as index
    • debug: log window focus

• Removed neomutt-sidebar-abbreviate-shorten-what-user-sees.patch. No longer needed.

• Update to 20200821:

  • Bug Fixes
    • fix maildir flag generation
    • fix query notmuch if file is missing
    • notmuch: don't abort sync on error
    • fix type checking for send config variables
  • Changed Config
    • $sidebar_format - Use %D rather than %B for named mailboxes
  • Translations
    • 96% Lithuanian
    • 90% Polish

• fix(sidebar): abbreviate/shorten what user sees

• Fix sidebar mailbox name display problem.

• Update to 20200814:

  • Notes
    • Add one-liner docs to config items See: neomutt -O -Q smart_wrap
    • Remove the built-in editor A large unused and unusable feature
  • Security
    • Add mitigation against DoS from thousands of parts boo#1179113
  • Features
    • Allow index-style searching in postpone menu
    • Open NeoMutt using a mailbox name
    • Add cd command to change the current working directory
    • Add tab-completion…

These are all security issues fixed in the mutt-2.0.7-2.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the neomutt-20210205-3.3 package on the GA media of openSUSE Tumbleweed.

This update for mutt fixes the following issues:

• CVE-2020-14954: Fixed a response injection due to a STARTTLS buffering issue which was affecting IMAP, SMTP, and POP3 (bsc#1173197).
• CVE-2020-14093: Fixed a potential IMAP Man-in-the-Middle attack via a PREAUTH response (bsc#1172906, bsc#1172935).
• CVE-2020-14154: Fixed an issue where Mutt was ignoring an expired certificate and was proceeding with a connection (bsc#1172906, bsc#1172935).

This update for mutt fixes the following issues:

• CVE-2020-14954: Fixed a response injection due to a STARTTLS buffering issue which was affecting IMAP, SMTP, and POP3 (bsc#1173197).
• CVE-2020-14093: Fixed a potential IMAP Man-in-the-Middle attack via a PREAUTH response (bsc#1172906, bsc#1172935).
• CVE-2020-14154: Fixed an issue where Mutt was ignoring an expired certificate and was proceeding with a connection (bsc#1172906, bsc#1172935).

This update for mutt fixes the following issues:

• CVE-2020-14954: Fixed a response injection due to a STARTTLS buffering issue which was affecting IMAP, SMTP, and POP3 (bsc#1173197).
• CVE-2020-14093: Fixed a potential IMAP Man-in-the-Middle attack via a PREAUTH response (bsc#1172906, bsc#1172935).
• CVE-2020-14154: Fixed an issue where Mutt was ignoring an expired certificate and was proceeding with a connection (bsc#1172906, bsc#1172935).

It was discovered that Mutt incorrectly handled certain requests. An attacker could possibly use this issue to enable MITM attacks. (CVE-2020-14954)

This update also address a regression caused in the last update USN-4401-1. It only affected Ubuntu 12.04 ESM, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 19.10.

Jeriko One discovered that NeoMutt incorrectly handled certain IMAP and POP3 responses. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in a denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14349, CVE-2018-14350, CVE-2018-14351, CVE-2018-14352, CVE-2018-14353, CVE-2018-14354, CVE-2018-14355, CVE-2018-14356, CVE-2018-14357, CVE-2018-14358, CVE-2018-14359, CVE-2018-14362)

Jeriko One discovered that NeoMutt incorrectly handled certain NNTP-related operations. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14360, CVE-2018-14361, CVE-2018-14363)

It was discovered that NeoMutt incorrectly processed additional data when communicating with mail servers. An attacker could possibly use this issue to access senstive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14954, CVE-2020-28896)

It was discovered that Neomutt incorrectly handled the IMAP QRSync setting. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-32055)

Tavis Ormandy discovered that NeoMutt incorrectly parsed uuencoded text past the length of the string. An attacker could possibly use this issue to enable the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1328)

It was discovered that NeoMutt did not properly encrypt email headers. An attacker could possibly use this issue to receive emails that were not intended for them and access sensitive information. This vulnerability was only fixed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-49393, CVE-2024-49394)