CVE-2020-28896

Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.

Mutt is a small but very powerful text-based mail client for Unix operating systems.\r\n\r\n Security Fix(es):\r\n\r\n Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.(CVE-2020-28896)\r\n\r\n

Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP.

The following packages have been upgraded to a later upstream version: mutt (2.0.7). (BZ#1912614)

Security Fix(es):

• mutt: Incorrect handling of invalid initial IMAP responses could lead to an authentication attempt over unencrypted connection (CVE-2020-28896)

• mutt: Memory leak when parsing rfc822 group addresses (CVE-2021-3181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.

Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP.

The following packages have been upgraded to a later upstream version: mutt (2.0.7). (BZ#1912614)

Security Fix(es):

• mutt: Incorrect handling of invalid initial IMAP responses could lead to an authentication attempt over unencrypted connection (CVE-2020-28896)

• mutt: Memory leak when parsing rfc822 group addresses (CVE-2021-3181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Mutt before 2.0.2 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle (CVE-2020-28896).

This update for neomutt fixes the following issues:

Update neomutt to 20201120. Address boo#1179035, CVE-2020-28896.

• Security
  • imap: close connection on all failures
• Features
  • alias: add function to Alias/Query dialogs
  • config: add validators for {imap,smtp,pop}_authenticators
  • config: warn when signature file is missing or not readable
  • smtp: support for native SMTP LOGIN auth mech
  • notmuch: show originating folder in index
• Bug Fixes
  • sidebar: prevent the divider colour bleeding out
  • sidebar: fix <sidebar-{next,prev}-new>
  • notmuch: fix query for current email
  • restore shutdown-hook functionality
  • crash in reply-to
  • user-after-free in folder-hook
  • fix some leaks
  • fix application of limits to modified mailboxes
  • write Date header when postponing
• Translations
  • 100% Lithuanian
  • 100% Czech
  • 70% Turkish
• Docs
  • Document that $sort_alias affects the query menu
• Build
  • improve ASAN flags
  • add SASL and S/MIME to --everything
  • fix contrib (un)install
• Code
  • my_hdr compose screen notifications
  • add contracts to the MXAPI
  • maildir refactoring
  • further reduce the use of global variables
• Upstream
  • Add $count_alternatives to count attachments inside alternatives

• Changes from 20200925

  • Features
    • Compose: display user-defined headers
    • Address Book / Query: live sorting
    • Address Book / Query: patterns for searching
    • Config: Add '+=' and '-=' operators for String Lists
    • Config: Add '+=' operator for Strings
    • Allow postfix query ':setenv NAME?' for env vars
  • Bug Fixes
    • Fix crash when searching with invalid regexes
    • Compose: Prevent infinite loop of send2-hooks
    • Fix sidebar on new/removed mailboxes
    • Restore indentation for named mailboxes
    • Prevent half-parsing an alias
    • Remove folder creation prompt for POP path
    • Show error if $message_cachedir doesn't point to a valid directory
    • Fix tracking LastDir in case of IMAP paths with Unicode characters
    • Make sure all mail gets applied the index limit
    • Add warnings to -Q query CLI option
    • Fix index tracking functionality
  • Changed Config
    • Add $compose_show_user_headers (yes)
  • Translations
    • 100% Czech
    • 100% Lithuanian
    • Split up usage strings
  • Build
    • Run shellcheck on hcachever.sh
    • Add the Address Sanitizer
    • Move compose files to lib under compose/
    • Move address config into libaddress
    • Update to latest acutest - fixes a memory leak in the unit tests
  • Code
    • Implement ARRAY API
    • Deglobalised the Config Sort functions
    • Refactor the Sidebar to be Event-Driven
    • Refactor the Color Event
    • Refactor the Commands list
    • Make ctx_update_tables private
    • Reduce the scope/deps of some Validator functions
    • Use the Email's IMAP UID instead of an increasing number as index
    • debug: log window focus

• Removed neomutt-sidebar-abbreviate-shorten-what-user-sees.patch. No longer needed.

• Update to 20200821:

  • Bug Fixes
    • fix maildir flag generation
    • fix query notmuch if file is missing
    • notmuch: don't abort sync on error
    • fix type checking for send config variables
  • Changed Config
    • $sidebar_format - Use %D rather than %B for named mailboxes
  • Translations
    • 96% Lithuanian
    • 90% Polish

• fix(sidebar): abbreviate/shorten what user sees

• Fix sidebar mailbox name display problem.

• Update to 20200814:

  • Notes
    • Add one-liner docs to config items See: neomutt -O -Q smart_wrap
    • Remove the built-in editor A large unused and unusable feature
  • Security
    • Add mitigation against DoS from thousands of parts boo#1179113
  • Features
    • Allow index-style searching in postpone menu
    • Open NeoMutt using a mailbox name
    • Add cd command to change the current working directory
    • Add tab-completion…

This update for mutt fixes the following issues:

• CVE-2020-28896: incomplete connection termination could lead to sending credentials over unencrypted connections (bsc#1179035)
• Avoid that message with a million tiny parts can freeze MUA for several minutes (bsc#1179113)

This update was imported from the SUSE:SLE-15:Update update project.

This update for mutt fixes the following issues:

• CVE-2020-28896: incomplete connection termination could lead to sending credentials over unencrypted connections (bsc#1179035)
• Avoid that message with a million tiny parts can freeze MUA for several minutes (bsc#1179113)

This update was imported from the SUSE:SLE-15:Update update project.

This update for neomutt fixes the following issues:

Update neomutt to 20201120. Address boo#1179035, CVE-2020-28896.

• Security
  • imap: close connection on all failures
• Features
  • alias: add function to Alias/Query dialogs
  • config: add validators for {imap,smtp,pop}_authenticators
  • config: warn when signature file is missing or not readable
  • smtp: support for native SMTP LOGIN auth mech
  • notmuch: show originating folder in index
• Bug Fixes
  • sidebar: prevent the divider colour bleeding out
  • sidebar: fix <sidebar-{next,prev}-new>
  • notmuch: fix query for current email
  • restore shutdown-hook functionality
  • crash in reply-to
  • user-after-free in folder-hook
  • fix some leaks
  • fix application of limits to modified mailboxes
  • write Date header when postponing
• Translations
  • 100% Lithuanian
  • 100% Czech
  • 70% Turkish
• Docs
  • Document that $sort_alias affects the query menu
• Build
  • improve ASAN flags
  • add SASL and S/MIME to --everything
  • fix contrib (un)install
• Code
  • my_hdr compose screen notifications
  • add contracts to the MXAPI
  • maildir refactoring
  • further reduce the use of global variables
• Upstream
  • Add $count_alternatives to count attachments inside alternatives

• Changes from 20200925

  • Features
    • Compose: display user-defined headers
    • Address Book / Query: live sorting
    • Address Book / Query: patterns for searching
    • Config: Add '+=' and '-=' operators for String Lists
    • Config: Add '+=' operator for Strings
    • Allow postfix query ':setenv NAME?' for env vars
  • Bug Fixes
    • Fix crash when searching with invalid regexes
    • Compose: Prevent infinite loop of send2-hooks
    • Fix sidebar on new/removed mailboxes
    • Restore indentation for named mailboxes
    • Prevent half-parsing an alias
    • Remove folder creation prompt for POP path
    • Show error if $message_cachedir doesn't point to a valid directory
    • Fix tracking LastDir in case of IMAP paths with Unicode characters
    • Make sure all mail gets applied the index limit
    • Add warnings to -Q query CLI option
    • Fix index tracking functionality
  • Changed Config
    • Add $compose_show_user_headers (yes)
  • Translations
    • 100% Czech
    • 100% Lithuanian
    • Split up usage strings
  • Build
    • Run shellcheck on hcachever.sh
    • Add the Address Sanitizer
    • Move compose files to lib under compose/
    • Move address config into libaddress
    • Update to latest acutest - fixes a memory leak in the unit tests
  • Code
    • Implement ARRAY API
    • Deglobalised the Config Sort functions
    • Refactor the Sidebar to be Event-Driven
    • Refactor the Color Event
    • Refactor the Commands list
    • Make ctx_update_tables private
    • Reduce the scope/deps of some Validator functions
    • Use the Email's IMAP UID instead of an increasing number as index
    • debug: log window focus

• Removed neomutt-sidebar-abbreviate-shorten-what-user-sees.patch. No longer needed.

• Update to 20200821:

  • Bug Fixes
    • fix maildir flag generation
    • fix query notmuch if file is missing
    • notmuch: don't abort sync on error
    • fix type checking for send config variables
  • Changed Config
    • $sidebar_format - Use %D rather than %B for named mailboxes
  • Translations
    • 96% Lithuanian
    • 90% Polish

• fix(sidebar): abbreviate/shorten what user sees

• Fix sidebar mailbox name display problem.

• Update to 20200814:

  • Notes
    • Add one-liner docs to config items See: neomutt -O -Q smart_wrap
    • Remove the built-in editor A large unused and unusable feature
  • Security
    • Add mitigation against DoS from thousands of parts boo#1179113
  • Features
    • Allow index-style searching in postpone menu
    • Open NeoMutt using a mailbox name
    • Add cd command to change the current working directory
    • Add tab-completion…

This update for neomutt fixes the following issues:

Update neomutt to 20201120. Address boo#1179035, CVE-2020-28896.

• Security
  • imap: close connection on all failures
• Features
  • alias: add function to Alias/Query dialogs
  • config: add validators for {imap,smtp,pop}_authenticators
  • config: warn when signature file is missing or not readable
  • smtp: support for native SMTP LOGIN auth mech
  • notmuch: show originating folder in index
• Bug Fixes
  • sidebar: prevent the divider colour bleeding out
  • sidebar: fix <sidebar-{next,prev}-new>
  • notmuch: fix query for current email
  • restore shutdown-hook functionality
  • crash in reply-to
  • user-after-free in folder-hook
  • fix some leaks
  • fix application of limits to modified mailboxes
  • write Date header when postponing
• Translations
  • 100% Lithuanian
  • 100% Czech
  • 70% Turkish
• Docs
  • Document that $sort_alias affects the query menu
• Build
  • improve ASAN flags
  • add SASL and S/MIME to --everything
  • fix contrib (un)install
• Code
  • my_hdr compose screen notifications
  • add contracts to the MXAPI
  • maildir refactoring
  • further reduce the use of global variables
• Upstream
  • Add $count_alternatives to count attachments inside alternatives

• Changes from 20200925

  • Features
    • Compose: display user-defined headers
    • Address Book / Query: live sorting
    • Address Book / Query: patterns for searching
    • Config: Add '+=' and '-=' operators for String Lists
    • Config: Add '+=' operator for Strings
    • Allow postfix query ':setenv NAME?' for env vars
  • Bug Fixes
    • Fix crash when searching with invalid regexes
    • Compose: Prevent infinite loop of send2-hooks
    • Fix sidebar on new/removed mailboxes
    • Restore indentation for named mailboxes
    • Prevent half-parsing an alias
    • Remove folder creation prompt for POP path
    • Show error if $message_cachedir doesn't point to a valid directory
    • Fix tracking LastDir in case of IMAP paths with Unicode characters
    • Make sure all mail gets applied the index limit
    • Add warnings to -Q query CLI option
    • Fix index tracking functionality
  • Changed Config
    • Add $compose_show_user_headers (yes)
  • Translations
    • 100% Czech
    • 100% Lithuanian
    • Split up usage strings
  • Build
    • Run shellcheck on hcachever.sh
    • Add the Address Sanitizer
    • Move compose files to lib under compose/
    • Move address config into libaddress
    • Update to latest acutest - fixes a memory leak in the unit tests
  • Code
    • Implement ARRAY API
    • Deglobalised the Config Sort functions
    • Refactor the Sidebar to be Event-Driven
    • Refactor the Color Event
    • Refactor the Commands list
    • Make ctx_update_tables private
    • Reduce the scope/deps of some Validator functions
    • Use the Email's IMAP UID instead of an increasing number as index
    • debug: log window focus

• Removed neomutt-sidebar-abbreviate-shorten-what-user-sees.patch. No longer needed.

• Update to 20200821:

  • Bug Fixes
    • fix maildir flag generation
    • fix query notmuch if file is missing
    • notmuch: don't abort sync on error
    • fix type checking for send config variables
  • Changed Config
    • $sidebar_format - Use %D rather than %B for named mailboxes
  • Translations
    • 96% Lithuanian
    • 90% Polish

• fix(sidebar): abbreviate/shorten what user sees

• Fix sidebar mailbox name display problem.

• Update to 20200814:

  • Notes
    • Add one-liner docs to config items See: neomutt -O -Q smart_wrap
    • Remove the built-in editor A large unused and unusable feature
  • Security
    • Add mitigation against DoS from thousands of parts boo#1179113
  • Features
    • Allow index-style searching in postpone menu
    • Open NeoMutt using a mailbox name
    • Add cd command to change the current working directory
    • Add tab-completion…

These are all security issues fixed in the mutt-2.0.7-2.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the neomutt-20210205-3.3 package on the GA media of openSUSE Tumbleweed.

This update for mutt fixes the following issues:

• CVE-2020-28896: incomplete connection termination could lead to sending credentials over unencrypted connections (bsc#1179035)
• Avoid that message with a million tiny parts can freeze MUA for several minutes (bsc#1179113)

This update for mutt fixes the following issues:

• CVE-2020-28896: incomplete connection termination could lead to sending credentials over unencrypted connections (bsc#1179035)
• Avoid that message with a million tiny parts can freeze MUA for several minutes (bsc#1179113)

This update for mutt fixes the following issues:

• Find and display the content of messages properly. (bsc#1179461)
• CVE-2020-28896: incomplete connection termination could send credentials over unencrypted connections. (bsc#1179035)
• Avoid that message with a million tiny parts can freeze MUA for several minutes. (bsc#1179113)

It was discovered that Mutt incorrectly handled certain connections. An attacker could possibly use this issue to expose sensitive information.

Jeriko One discovered that NeoMutt incorrectly handled certain IMAP and POP3 responses. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in a denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14349, CVE-2018-14350, CVE-2018-14351, CVE-2018-14352, CVE-2018-14353, CVE-2018-14354, CVE-2018-14355, CVE-2018-14356, CVE-2018-14357, CVE-2018-14358, CVE-2018-14359, CVE-2018-14362)

Jeriko One discovered that NeoMutt incorrectly handled certain NNTP-related operations. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14360, CVE-2018-14361, CVE-2018-14363)

It was discovered that NeoMutt incorrectly processed additional data when communicating with mail servers. An attacker could possibly use this issue to access senstive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14954, CVE-2020-28896)

It was discovered that Neomutt incorrectly handled the IMAP QRSync setting. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-32055)

Tavis Ormandy discovered that NeoMutt incorrectly parsed uuencoded text past the length of the string. An attacker could possibly use this issue to enable the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1328)

It was discovered that NeoMutt did not properly encrypt email headers. An attacker could possibly use this issue to receive emails that were not intended for them and access sensitive information. This vulnerability was only fixed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-49393, CVE-2024-49394)