{"id":"CVE-2020-14929","aliases":["ALPINE-CVE-2020-14929","DEBIAN-CVE-2020-14929","DLA-2254-1","EUVD-2020-7065","GHSA-2h9h-wfvh-5r96","MGASA-2021-0014","UBUNTU-CVE-2020-14929","USN-7360-1","openSUSE-SU-2021:0675-1","openSUSE-SU-2021:0695-1","openSUSE-SU-2024:10613-1"],"status":"published","title":"Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in...","description":"Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01869,"percentile":0.79609,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2020-06-19T18:58:59Z","modified":"2026-11-03T06:32:30Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"alpine","fixed_in":["2.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"alpine","fixed_in":["2.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"alpine","fixed_in":["2.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"alpine","fixed_in":["2.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"alpine","fixed_in":["2.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"alpine","fixed_in":["2.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"alpine","fixed_in":["2.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"alpine","fixed_in":["2.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"alpine","fixed_in":["2.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"alpine","fixed_in":["2.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"alpine","fixed_in":["2.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"alpine","fixed_in":["2.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"alpine","fixed_in":["2.23-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"alpine","fixed_in":["2.23+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"alpine","fixed_in":["2.23+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"alpine","fixed_in":["2.23+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"alpine","fixed_in":["2.11+dfsg1-3+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"alpine","fixed_in":["2.11-5.1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"c-client","fixed_in":["2007f-13.1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"alpine","fixed_in":["2.20+dfsg1-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"alpine","fixed_in":["2.21+dfsg1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"alpine","fixed_in":["2.22+dfsg1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"alpine","fixed_in":["2.24-lp152.5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"alpine","fixed_in":["2.24-bp152.4.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg1-3+deb8u1"}]}],"versions":["2.11+dfsg1-3"]},{"source":"osv","ecosystem":"Mageia:7","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-5.1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"c-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2007f-13.1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20+dfsg1-2ubuntu0.1~esm1"}]}],"versions":["2.20+dfsg1-1","2.20+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["2.20+dfsg1-7","2.21+dfsg1-1","2.21+dfsg1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["2.21+dfsg1-1.1build1","2.22+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20+dfsg1-2ubuntu0.1~esm1"}]}],"versions":["2.20+dfsg1-1","2.20+dfsg1-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["2.20+dfsg1-7","2.21+dfsg1-1","2.21+dfsg1-1build1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["2.21+dfsg1-1.1build1","2.22+dfsg1-1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24-lp152.5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"alpine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24-bp152.4.3.1"}]}]}],"products":[{"vendor":"alpine_project","product":"alpine"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"http://mailman13.u.washington.edu/pipermail/alpine-info/2020-June/008989.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/06/msg00025.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZJLY6JDVGDNAJZ3UQDWYWSDBWOAOXMNX/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFXQGKZZMP3VSTLZVO5Z7Z6USYIW37A6/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14929"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFXQGKZZMP3VSTLZVO5Z7Z6USYIW37A6/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZJLY6JDVGDNAJZ3UQDWYWSDBWOAOXMNX/"},{"url":"https://github.com/advisories/GHSA-2h9h-wfvh-5r96"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-14929","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-14929","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0014.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26880","tags":["report"]},{"url":"https://www.debian.org/lts/security/2020/dla-2254","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-14929","tags":["report"]},{"url":"https://repo.or.cz/alpine.git/commitdiff/000edd9036b6aea5e6a06900ecd6c58faec665ab","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14929","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7360-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-38370","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-46853","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7ZRQIHG7XRVXHNCK66IMEPQ7LPQIJT4P/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173281","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14929","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/A75UA3SG5RXQXANEALFPKTVRRYONZKUR/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-14929","description":"Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.","status":"published","published":"2020-06-19T18:58:59Z","modified":"2024-08-04T13:00:51.991Z","updated_at":"2026-11-02T14:35:46.476719Z"}],"euvd":[{"id":"EUVD-2020-7065","description":"Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.","status":"published","published":"2020-06-19T18:58:59Z","modified":"2024-08-04T13:00:51Z","updated_at":"2026-11-03T03:07:33.617168Z"}],"ghsa":[{"id":"GHSA-2h9h-wfvh-5r96","title":"Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in...","description":"Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.","status":"published","published":"2022-05-24T17:21:18Z","modified":"2023-01-27T05:02:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:42:07.495183Z"}],"nvd":[{"id":"CVE-2020-14929","description":"Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.","status":"published","published":"2020-06-19T19:15:12.687Z","modified":"2026-06-17T02:55:47.45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:07.249892Z"}],"osv":[{"id":"ALPINE-CVE-2020-14929","description":"Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.","status":"published","published":"2020-06-19T19:15:12.687Z","modified":"2026-11-03T06:32:30.940513848Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"CVE-2020-14929","description":"Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.","status":"published","published":"2020-06-19T19:15:12.687Z","modified":"2026-04-16T04:39:18.448237789Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-14929","description":"Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.","status":"published","published":"2020-06-19T19:15:12.687Z","modified":"2026-10-26T12:02:26.764764098Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"UBUNTU-CVE-2020-14929","description":"Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.","status":"published","published":"2020-06-19T19:15:00Z","modified":"2026-02-04T02:48:20.974439Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"DLA-2254-1","title":"alpine - security update","status":"published","published":"2020-06-25T00:00:00Z","modified":"2026-03-09T01:18:26.298436Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2021-0014","title":"Updated alpine and c-client packages fix security vulnerability","description":"Alpine before 2.23 silently proceeds to use an insecure connection after a /tls\nis sent in certain circumstances involving PREAUTH, which is a less secure\nbehavior than the alternative of closing the connection and letting the user\ndecide what they would like to do (CVE-2020-14929).\n","status":"published","published":"2021-01-10T19:46:12Z","modified":"2026-04-16T04:43:54.863954451Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0675-1","title":"Security update for alpine","description":"This update for alpine fixes the following issues:\n\nUpdate to release 2.24\n\n* A few crash fixes\n* Implementation of XOAUTH2 for Yahoo! Mail.\n\nUpdate to release 2.23.2\n\n* Expansion of the configuration screen for XOAUTH2 to include\n  username, and tenant.\n* Alpine uses the domain in the From: header of a message\n  to generate a message-id and suppresses all information\n  about Alpine, version, revision, and time of generation\n  of the message-id from this header.\n* Alpine does not generate Sender or X-X-Sender by default by\n  enabling [X] Disable Sender as the default.\n* Alpine does not disclose User Agent by default by enabling\n  [X] Suppress User Agent by default.\n* When messages are selected, pressing the ';' command to\n  broaden or narrow a search, now offers the possibility to\n  completely replace the search, and is almost equivalent to\n  being a shortcut to 'unselect all messages, and select\n  again'.\n\nUpdate to release 2.23\n\n* Fixes boo#1173281, CVE-2020-14929: Alpine silently proceeds to\n  use an insecure connection after a /tls is sent in certain\n  circumstances.\n* Implementation of XOAUTH2 authentication support for Outlook.\n* Add support for the OAUTHBEARER authentication method in Gmail.\n* Support for the SASL-IR IMAP extension.\n* Alpine can pass an HTML message to an external web browser,\n  by using the 'External' command in the ATTACHMENT INDEX\n  screen.\n\nUpdate to release 2.22\n\n* Support for XOAUTH2 authentication method in Gmail. \n* NTLM authentication support with the ntlm library.\n* Added the '/tls1_3' flag for servers that support it.\n* Add the 'g' option to the select command that works in IMAP\n  servers that implement the X-GM-EXT-1 capability (such as the\n  one offered by Gmail).\n* Added '/auth=XYZ' to the way to define a server. This allows\n  users to select the method to authenticate to an IMAP, SMTP\n  or POP3 server. Examples are /auth=plain, or /auth=gssapi,\n  etc.\n* When a message is of type multipart/mixed, and its first part\n  is multipart/signed, Alpine will include the text of the\n  original message in a reply message, instead of including a\n  multipart attachment.\n* Added backward search in the index screen.\n* pico: Add -dict option to Pico, which allows users to choose a\n  dictionary when spelling.\n- Drop /usr/bin/mailutil, it is not built by default anymore.\n\n* Added Quota subcommands for printing, forwarding, saving, etc.\n","status":"published","published":"2021-05-06T12:06:14Z","modified":"2026-02-04T04:03:30.571796Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0695-1","title":"Security update for alpine","description":"This update for alpine fixes the following issues:\n\nUpdate to release 2.24\n\n* A few crash fixes\n* Implementation of XOAUTH2 for Yahoo! Mail.\n\nUpdate to release 2.23.2\n\n* Expansion of the configuration screen for XOAUTH2 to include\n  username, and tenant.\n* Alpine uses the domain in the From: header of a message\n  to generate a message-id and suppresses all information\n  about Alpine, version, revision, and time of generation\n  of the message-id from this header.\n* Alpine does not generate Sender or X-X-Sender by default by\n  enabling [X] Disable Sender as the default.\n* Alpine does not disclose User Agent by default by enabling\n  [X] Suppress User Agent by default.\n* When messages are selected, pressing the ';' command to\n  broaden or narrow a search, now offers the possibility to\n  completely replace the search, and is almost equivalent to\n  being a shortcut to 'unselect all messages, and select\n  again'.\n\nUpdate to release 2.23\n\n* Fixes boo#1173281, CVE-2020-14929: Alpine silently proceeds to\n  use an insecure connection after a /tls is sent in certain\n  circumstances.\n* Implementation of XOAUTH2 authentication support for Outlook.\n* Add support for the OAUTHBEARER authentication method in Gmail.\n* Support for the SASL-IR IMAP extension.\n* Alpine can pass an HTML message to an external web browser,\n  by using the 'External' command in the ATTACHMENT INDEX\n  screen.\n\nUpdate to release 2.22\n\n* Support for XOAUTH2 authentication method in Gmail. \n* NTLM authentication support with the ntlm library.\n* Added the '/tls1_3' flag for servers that support it.\n* Add the 'g' option to the select command that works in IMAP\n  servers that implement the X-GM-EXT-1 capability (such as the\n  one offered by Gmail).\n* Added '/auth=XYZ' to the way to define a server. This allows\n  users to select the method to authenticate to an IMAP, SMTP\n  or POP3 server. Examples are /auth=plain, or /auth=gssapi,\n  etc.\n* When a message is of type multipart/mixed, and its first part\n  is multipart/signed, Alpine will include the text of the\n  original message in a reply message, instead of including a\n  multipart attachment.\n* Added backward search in the index screen.\n* pico: Add -dict option to Pico, which allows users to choose a\n  dictionary when spelling.\n- Drop /usr/bin/mailutil, it is not built by default anymore.\n\n* Added Quota subcommands for printing, forwarding, saving, etc.\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-05-09T18:05:43Z","modified":"2026-02-04T04:20:12.608678Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10613-1","title":"alpine-2.25-24.1 on GA media","description":"These are all security issues fixed in the alpine-2.25-24.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:34:31.263266Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-7360-1","title":"alpine vulnerabilities","description":"It was discovered that Alpine did not use a secure connection under\ncertain circumstances. A remote attacker could possibly use this issue to\nleak sensitive information. (CVE-2020-14929)\n\nIt was discovered that Alpine could allow untagged responses from an\nIMAP server before upgrading to a TLS connection. A remote attacker could\npossibly use this issue to leak sensitive information. (CVE-2021-38370)\n\nIt was discovered that Alpine could crash when receiving certain SMTP\ncommands. A remote attacker could possibly use this issue to cause a denial\nof service. (CVE-2021-46853)\n","status":"published","published":"2025-03-20T00:37:09Z","modified":"2026-06-25T13:32:19.393957414Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}