{"id":"CVE-2020-15953","aliases":["ALPINE-CVE-2020-15953","DEBIAN-CVE-2020-15953","DLA-2329-1","EUVD-2020-7924","GHSA-f329-rp43-94r4","MGASA-2020-0366","UBUNTU-CVE-2020-15953","USN-4598-1","openSUSE-SU-2020:1454-1","openSUSE-SU-2020:1505-1","openSUSE-SU-2024:10938-1"],"status":"published","title":"LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS...","description":"LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a \"begin TLS\" response, the client reads additional data (e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS context, aka \"response injection.\"","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02404,"percentile":0.84274,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2020-07-27T06:07:04Z","modified":"2026-11-03T06:32:24Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"libetpan","fixed_in":["1.9.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libetpan","fixed_in":["1.9.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libetpan","fixed_in":["1.9.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libetpan","fixed_in":["1.9.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libetpan","fixed_in":["1.9.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libetpan","fixed_in":["1.9.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libetpan","fixed_in":["1.9.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libetpan","fixed_in":["1.9.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libetpan","fixed_in":["1.9.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libetpan","fixed_in":["1.9.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libetpan","fixed_in":["1.9.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libetpan","fixed_in":["1.9.4-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libetpan","fixed_in":["1.9.4-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libetpan","fixed_in":["1.9.4-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libetpan","fixed_in":["1.9.4-3"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"libetpan","fixed_in":["1.6-3+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"libetpan","fixed_in":["1.9.3-1.1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libetpan","fixed_in":["1.6-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"libetpan","fixed_in":["1.9.4-lp152.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"libetpan","fixed_in":["1.9.4-bp152.4.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-3+deb9u1"}]}],"versions":["1.6-3"]},{"source":"osv","ecosystem":"Mageia:7","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-1ubuntu0.1"}]}],"versions":["1.5-2","1.6-1","1.6-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.0-1","1.8.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3-2","1.9.4-2","1.9.4-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.4-3","1.9.4-3+deb11u1build0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.4-3.1","1.9.4-3.2","1.9.4-3.2build1","1.9.4-3.2build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.4-5","1.9.4-6"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.4-8","1.10.0-1","1.10.0-1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.4-6","1.9.4-7","1.9.4-8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-1ubuntu0.1"}]}],"versions":["1.5-2","1.6-1","1.6-1build1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-lp152.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"libetpan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-bp152.4.3.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libetpan_project","product":"libetpan"},{"vendor":"libmailcore","product":"mailcore2"}],"references":[{"url":"https://github.com/dinhvh/libetpan/issues/386","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix"]},{"url":"https://security.gentoo.org/glsa/202007-55","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00026.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QFBWNA5REI5ZGW2DAOEAVHM23MOU6O5J/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M65FVH5XPS23NLHFN3ABEGBSCHZAISXN/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00060.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00075.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15953"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M65FVH5XPS23NLHFN3ABEGBSCHZAISXN/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QFBWNA5REI5ZGW2DAOEAVHM23MOU6O5J/"},{"url":"https://github.com/advisories/GHSA-f329-rp43-94r4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-15953","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-15953","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0366.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27168","tags":["report"]},{"url":"https://www.debian.org/lts/security/2020/dla-2329","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/QFBWNA5REI5ZGW2DAOEAVHM23MOU6O5J/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-15953","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4598-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15953","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/F2C43BTUZHFPWURMDLREL4PZZRBRGC5U/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1174579","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15953","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/624KGWQUAADPSLIFCDEK5LO4MMLCJJXJ/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8825","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-15953","description":"LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a \"begin TLS\" response, the client reads additional data (e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS context, aka \"response injection.\"","status":"published","published":"2020-07-27T06:07:04Z","modified":"2024-08-04T13:30:23.456Z","updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2020-7924","description":"LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a \"begin TLS\" response, the client reads additional data (e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS context, aka \"response injection.\"","status":"published","published":"2020-07-27T06:07:04Z","modified":"2024-08-04T13:30:23Z","updated_at":"2026-11-03T03:07:29.843843Z"}],"ghsa":[{"id":"GHSA-f329-rp43-94r4","title":"LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS...","description":"LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a \"begin TLS\" response, the client reads additional data (e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS context, aka \"response injection.\"","status":"published","published":"2022-05-24T17:24:21Z","modified":"2023-01-28T05:06:22Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:44:25.86191Z"}],"nvd":[{"id":"CVE-2020-15953","description":"LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a \"begin TLS\" response, the client reads additional data (e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS context, aka \"response injection.\"","status":"published","published":"2020-07-27T07:15:10.91Z","modified":"2026-06-17T02:57:28.98Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:06:10.086163Z"}],"osv":[{"id":"ALPINE-CVE-2020-15953","description":"LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a \"begin TLS\" response, the client reads additional data (e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS context, aka \"response injection.\"","status":"published","published":"2020-07-27T07:15:10.91Z","modified":"2026-11-03T06:32:24.264504804Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-15953","description":"LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a \"begin TLS\" response, the client reads additional data (e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS context, aka \"response injection.\"","status":"published","published":"2020-07-27T07:15:10.91Z","modified":"2026-10-24T10:47:48.521517268Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"DEBIAN-CVE-2020-15953","description":"LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a \"begin TLS\" response, the client reads additional data (e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS context, aka \"response injection.\"","status":"published","published":"2020-07-27T07:15:10.91Z","modified":"2026-10-26T12:02:27.375919012Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"UBUNTU-CVE-2020-15953","description":"LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a \"begin TLS\" response, the client reads additional data (e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS context, aka \"response injection.\"","status":"published","published":"2020-07-27T07:15:00Z","modified":"2026-10-17T12:56:11.669294452Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"DLA-2329-1","title":"libetpan - security update","status":"published","published":"2020-08-16T00:00:00Z","modified":"2026-03-09T01:22:50.454292Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2020-0366","title":"Updated libetpan packages fix a security vulnerability","description":"LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other\nproducts, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3.\nWhen a server sends a \"begin TLS\" response, the client reads additional data\n(e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS\ncontext, aka \"response injection\". (CVE-2020-15953).\n","status":"published","published":"2020-09-15T11:45:52Z","modified":"2026-04-16T04:44:28.82506452Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:1454-1","title":"Security update for libetpan","description":"This update for libetpan fixes the following issues:\n\nUpdate to 1.9.4 (boo#1174579, CVE-2020-15953):\n\n* Bugfixes on QUOTA\n* Varios warning fixes \u0026 build fixes \n\nUpdate to version 1.9.3\n\n* Added IMAP CLIENTID / SMTP CLIENTID support\n* Use Cyrus SASL 2.1.27\n\nUpdate to version 1.9.2\n\n* Support of TLS SNI\n* LMDB for cache DB\n* Fixed build with recent versions of curl\n","status":"published","published":"2020-09-19T12:20:45Z","modified":"2026-02-04T02:58:20.751109Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1505-1","title":"Security update for libetpan","description":"This update for libetpan fixes the following issues:\n\nUpdate to 1.9.4 (boo#1174579, CVE-2020-15953):\n\n* Bugfixes on QUOTA\n* Varios warning fixes \u0026 build fixes \n\nUpdate to version 1.9.3\n\n* Added IMAP CLIENTID / SMTP CLIENTID support\n* Use Cyrus SASL 2.1.27\n\nUpdate to version 1.9.2\n\n* Support of TLS SNI\n* LMDB for cache DB\n* Fixed build with recent versions of curl\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2020-09-22T16:22:35Z","modified":"2026-02-04T02:24:11.282341Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:10938-1","title":"libetpan-devel-1.9.4-1.7 on GA media","description":"These are all security issues fixed in the libetpan-devel-1.9.4-1.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:37:20.393323Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-4598-1","title":"libetpan vulnerability","description":"It was discovered that LibEtPan incorrectly handled STARTTLS when using\nIMAP, SMTP and POP3. A remote attacker could possibly use this issue\nto perform a response injection attack. (CVE-2020-15953)\n","status":"published","published":"2020-10-22T13:22:09Z","modified":"2026-04-27T18:43:21.820074Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}