{"id":"CVE-2014-2576","aliases":["DEBIAN-CVE-2014-2576","EUVD-2014-2608","GHSA-fc99-wqm7-mj5r","MGASA-2014-0449"],"status":"published","title":"plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN...","description":"plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01997,"percentile":0.80839,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2014-10-15T14:00:00Z","modified":"2026-10-23T15:47:30Z","fixes":[{"ecosystem":"Debian:12","package":"claws-mail","fixed_in":["3.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"claws-mail","fixed_in":["3.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"claws-mail","fixed_in":["3.10.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"claws-mail","fixed_in":["3.11.1-1.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.1-1.mga4"}]}]}],"products":[{"vendor":"claws-mail","product":"claws-mail"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://secunia.com/advisories/60422","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-10/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3106","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://seclists.org/oss-sec/2014/q1/636","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://sourceforge.net/p/claws-mail/news/2014/05/claws-mail-3100-unleashed/","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2576"},{"url":"http://sourceforge.net/p/claws-mail/news/2014/05/claws-mail-3100-unleashed"},{"url":"https://github.com/advisories/GHSA-fc99-wqm7-mj5r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-2576","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0449.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14281","tags":["report"]},{"url":"http://www.claws-mail.org/news.php","tags":["web"]},{"url":"http://sourceforge.net/p/claws-mail/news/","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-2576","description":"plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.","status":"published","published":"2014-10-15T14:00:00Z","modified":"2024-08-06T10:21:34.633Z","updated_at":"2026-11-02T14:33:43.883586Z"}],"euvd":[{"id":"EUVD-2014-2608","description":"plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.","status":"published","published":"2014-10-15T14:00:00Z","modified":"2024-08-06T10:21:34Z","updated_at":"2026-11-03T01:57:14.00634Z"}],"ghsa":[{"id":"GHSA-fc99-wqm7-mj5r","title":"plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN...","description":"plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.","status":"published","published":"2022-05-14T02:09:24Z","modified":"2025-04-12T12:40:46Z","updated_at":"2026-11-02T15:01:18.899916Z"}],"nvd":[{"id":"CVE-2014-2576","description":"plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.","status":"published","published":"2014-10-15T14:55:06.29Z","modified":"2026-06-17T00:06:49.627Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:56.266125Z"}],"osv":[{"id":"CVE-2014-2576","description":"plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.","status":"published","published":"2014-10-15T14:55:06Z","modified":"2026-04-16T06:22:50.010496117Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-2576","description":"plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.","status":"published","published":"2014-10-15T14:55:06.29Z","modified":"2026-10-23T15:47:30.942115503Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0449","title":"Updated claws-mail package fixes security vulnerability","description":"This update provides claws-mail version 3.11.1, which includes several fixes\nand improvements related to SSL/TLS, and fixes other bugs as well.  See the\nupstream news for more details.\n","status":"published","published":"2014-11-14T11:50:06Z","modified":"2026-04-16T06:24:28.809339836Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}