{"id":"CVE-2024-49393","aliases":["DEBIAN-CVE-2024-49393","EUVD-2024-43420","GHSA-hchw-xwhf-3qvm","MGASA-2025-0070","UBUNTU-CVE-2024-49393","USN-7204-1","openSUSE-SU-2024:14527-1"],"status":"published","title":"Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing","description":"In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00327,"percentile":0.26125,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2024-11-12T01:55:40Z","modified":"2026-11-05T13:17:06Z","fixes":[{"ecosystem":"Debian:13","package":"neomutt","fixed_in":["20241002+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"neomutt","fixed_in":["20241002+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"neomutt","fixed_in":["20191207+dfsg.1-1.1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"neomutt","fixed_in":["20211029+dfsg1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"neomutt","fixed_in":["20231103+dfsg1-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.12-0.1","2.2.12-0.1~deb12u1","2.2.13-1","2.2.9-1","2.2.9-1+deb12u1","2.3.2-1","2.4.0-1","2.4.1-1","2.4.1-1.1"]},{"source":"osv","ecosystem":"Debian:13","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.13-1","2.2.13-1+deb13u1","2.2.13-1+deb13u2","2.3.2-1","2.4.0-1","2.4.1-1","2.4.1-1.1"]},{"source":"osv","ecosystem":"Debian:14","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.13-1","2.3.2-1","2.4.0-1","2.4.1-1","2.4.1-1.1"]},{"source":"osv","ecosystem":"Debian:12","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20220429+dfsg1-4.1","20231103+dfsg1-1","20240425+dfsg-1","20240425+dfsg-2","20241002+dfsg-1","20241002+dfsg-1~bpo12+1","20241114+dfsg-1","20241114+dfsg1-1","20241212+dfsg-1","20241212+dfsg-2","20250109+dfsg-1","20250113+dfsg-1","20250113+dfsg-1~bpo12+1","20250404+dfsg-1","20250404+dfsg-1~bpo12+1","20250404+dfsg-2","20250404+dfsg-2~bpo12+1","20250404+dfsg-2~bpo12+2","20250510+dfsg-1","20250510+dfsg-2","20250510+dfsg-2~bpo12+1","20250905+dfsg-1","20251211+dfsg-1","20260105+dfsg-1","20260105+dfsg-1~bpo13+1","20260406+dfsg-1","20260504+dfsg-1","20260616+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20241002+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20241002+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20241002-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.23-3.1ubuntu1","1.5.23-3.1ubuntu2","1.5.24-1","1.5.24-1build1","1.5.24-1ubuntu0.1","1.5.24-1ubuntu0.2","1.5.24-1ubuntu0.3","1.5.24-1ubuntu0.4","1.5.24-1ubuntu0.5","1.5.24-1ubuntu0.6","1.5.24-1ubuntu0.6+esm2","1.5.24-1ubuntu0.6+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3+neomutt20170609-2build1","1.9.1-2","1.9.1-3","1.9.1-4","1.9.1-5","1.9.2-1","1.9.3-1","1.9.4-2","1.9.4-3","1.9.4-3ubuntu0.1","1.9.4-3ubuntu0.2","1.9.4-3ubuntu0.3","1.9.4-3ubuntu0.4","1.9.4-3ubuntu0.5","1.9.4-3ubuntu0.6","1.9.4-3ubuntu0.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20171027-1","20171027-2","20171027+dfsg.1-1","20171027+dfsg.1-2","20171027+dfsg.1-4","20171208+dfsg.1-1","20171208+dfsg.1-2","20171215+dfsg.1-1","20171215+dfsg.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1-2.1","1.12.2-1","1.12.2-2","1.13.0-1","1.13.2-1","1.13.2-1ubuntu0.1","1.13.2-1ubuntu0.2","1.13.2-1ubuntu0.3","1.13.2-1ubuntu0.4","1.13.2-1ubuntu0.5","1.13.2-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20191207+dfsg.1-1.1ubuntu0.1~esm1"}]}],"versions":["20180716+dfsg.1-1.2","20191111+dfsg.1-1","20191207+dfsg.1-1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.5-4.1build1","2.1.3-1","2.1.4-1","2.1.4-1build1","2.1.4-1ubuntu1.1","2.1.4-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20211029+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["20201127+dfsg.1-1.2","20211029+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.9-1","2.2.9-1ubuntu0.23.10.1","2.2.12-0.1","2.2.12-0.1build2","2.2.12-0.1build3","2.2.12-0.1build4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20231103+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["20220429+dfsg1-4.1","20231103+dfsg1-1","20231103+dfsg1-1build2","20231103+dfsg1-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.13-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.13-1build2","2.3.2-1","2.4.0-1","2.4.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.13-1","2.2.13-1build1","2.2.13-1build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20171215+dfsg.1-1ubuntu0.1~esm1"}]}],"versions":["20171027-1","20171027-2","20171027+dfsg.1-1","20171027+dfsg.1-2","20171027+dfsg.1-4","20171208+dfsg.1-1","20171208+dfsg.1-2","20171215+dfsg.1-1"],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20191207+dfsg.1-1.1ubuntu0.1~esm1"}]}],"versions":["20180716+dfsg.1-1.2","20191111+dfsg.1-1","20191207+dfsg.1-1.1"],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20211029+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["20201127+dfsg.1-1.2","20211029+dfsg1-1"],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20231103+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["20220429+dfsg1-4.1","20231103+dfsg1-1","20231103+dfsg1-1build2","20231103+dfsg1-1build3"],"bundled":21},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20241114-1.1"}]}],"bundled":2}],"products":[{"vendor":"mutt","product":"mutt"},{"vendor":"neomutt","product":"neomutt"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-49393","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2325317","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/neomutt/neomutt/issues/4223"},{"url":"https://github.com/neomutt/neomutt/pull/4221"},{"url":"https://github.com/neomutt/neomutt/pull/4227"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49393"},{"url":"https://github.com/advisories/GHSA-hchw-xwhf-3qvm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-49393","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0070.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33814","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ZYFPGXOX4Q4I4UNPEGXP2N372IN2YSAS/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-49393","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-49393","tags":["report"]},{"url":"https://gitlab.com/muttmua/mutt/-/issues/490#note_2209448655","tags":["report"]},{"url":"http://mutt.org/doc/manual/#crypt-protected-headers-read","tags":["report"]},{"url":"https://github.com/neomutt/neomutt/commit/913a991a5a8a000c0acc761dd8c9b76eefabfbea","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7204-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-14349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14352","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14353","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14355","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14356","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14358","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14359","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-14954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-28896","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-1328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49394","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZYFPGXOX4Q4I4UNPEGXP2N372IN2YSAS/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49394","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-49393","title":"Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing","description":"In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.","status":"published","published":"2024-11-12T01:55:40.765Z","modified":"2026-11-05T13:01:19.124Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2024-43420","description":"In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.","status":"published","published":"2024-11-12T01:55:40Z","modified":"2026-11-05T13:01:19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T16:59:58.403219Z"}],"ghsa":[{"id":"GHSA-hchw-xwhf-3qvm","title":"In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which...","description":"In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.","status":"published","published":"2024-11-12T03:30:48Z","modified":"2026-06-26T03:31:25Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:08:59.978633Z"}],"nvd":[{"id":"CVE-2024-49393","description":"In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.","status":"published","published":"2024-11-12T02:15:18.443Z","modified":"2026-11-05T13:17:06.03Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-05T19:55:50.758755Z"}],"osv":[{"id":"CVE-2024-49393","description":"In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.","status":"published","published":"2024-11-12T02:15:18.443Z","modified":"2026-04-16T04:34:04.983634912Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:43.597758Z"},{"id":"DEBIAN-CVE-2024-49393","description":"In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.","status":"published","published":"2024-11-12T02:15:18.443Z","modified":"2026-11-02T12:02:53.718271507Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"UBUNTU-CVE-2024-49393","description":"In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.","status":"published","published":"2024-11-12T02:15:00Z","modified":"2026-10-17T12:56:45.491988317Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:06.818511Z"},{"id":"MGASA-2025-0070","title":"Updated neomutt packages fix security vulnerabilities","description":"The To and Cc email header fields are not protected by cryptographic\nsigning. (CVE-2024-49393)\nThe In-reply-to email header field is not protected by cryptographic signing.\n(CVE-2024-49394)\n","status":"published","published":"2025-02-24T18:29:49Z","modified":"2026-04-16T04:41:41.311882866Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2024:14527-1","title":"neomutt-20241114-1.1 on GA media","description":"These are all security issues fixed in the neomutt-20241114-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-26T00:00:00Z","modified":"2026-02-04T03:22:41.210312Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"USN-7204-1","title":"neomutt vulnerabilities","description":"Jeriko One discovered that NeoMutt incorrectly handled certain IMAP\nand POP3 responses. An attacker could possibly use this issue to\ncause NeoMutt to crash, resulting in a denial of service, or\nthe execution of arbitrary code. This issue only affected\nUbuntu 18.04 LTS. (CVE-2018-14349, CVE-2018-14350, CVE-2018-14351,\nCVE-2018-14352, CVE-2018-14353, CVE-2018-14354, CVE-2018-14355,\nCVE-2018-14356, CVE-2018-14357, CVE-2018-14358, CVE-2018-14359,\nCVE-2018-14362)\n\nJeriko One discovered that NeoMutt incorrectly handled certain\nNNTP-related operations. An attacker could possibly use this issue\nto cause NeoMutt to crash, resulting in denial of service, or\nthe execution of arbitrary code. This issue only affected\nUbuntu 18.04 LTS. (CVE-2018-14360, CVE-2018-14361, CVE-2018-14363)\n\nIt was discovered that NeoMutt incorrectly processed additional data\nwhen communicating with mail servers. An attacker could possibly use\nthis issue to access senstive information. This issue only affected\nUbuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14954, CVE-2020-28896)\n\nIt was discovered that Neomutt incorrectly handled the IMAP QRSync\nsetting. An attacker could possibly use this issue to cause NeoMutt\nto crash, resulting in denial of service. This issue only affected\nUbuntu 20.04 LTS. (CVE-2021-32055)\n\nTavis Ormandy discovered that NeoMutt incorrectly parsed uuencoded\ntext past the length of the string. An attacker could possibly use\nthis issue to enable the execution of arbitrary code. This issue\nonly affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and\nUbuntu 22.04 LTS. (CVE-2022-1328)\n\nIt was discovered that NeoMutt did not properly encrypt email headers.\nAn attacker could possibly use this issue to receive emails that were\nnot intended for them and access sensitive information. This\nvulnerability was only fixed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\nand Ubuntu 24.04 LTS. (CVE-2024-49393, CVE-2024-49394)\n","status":"published","published":"2025-01-15T16:07:30Z","modified":"2026-04-27T17:47:18.478449179Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}