CVE-2020-28896
low-risk
Published 2020-11-23
Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.
Do I need to act?
-
0.10% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10
Medium
NETWORK
/ HIGH complexity
Affected Products (3)
References (12)
Release Notes
https://github.com/neomutt/neomutt/releases/tag/20201120
Third Party Advisory
https://security.gentoo.org/glsa/202101-32
Release Notes
https://github.com/neomutt/neomutt/releases/tag/20201120
Third Party Advisory
https://security.gentoo.org/glsa/202101-32
26
/ 100
low-risk
Severity
17/34 · Moderate
Exploitability
0/34 · Minimal
Exposure
9/34 · Low