CVE-2020-14954
Fixed in a distro release EPSS 2%
Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."
Products: mutt, debian_linux, neomutt, fedoraproject fedora, canonical ubuntu_linux, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | mutt | 5:1.5.21-29.amzn2.0.1 |
| Debian 10 | mutt | 1.10.1-2.1+deb10u2 |
| Debian 10 | neomutt | 20180716+dfsg.1-1+deb10u1 |
| Debian 12 | mutt | 1.14.4-1 |
| Debian 12 | neomutt | 20200619+dfsg.1-1 |
| Debian 13 | mutt | 1.14.4-1 |
| Debian 13 | neomutt | 20200619+dfsg.1-1 |
| Debian 14 | mutt | 1.14.4-1 |
| Debian 14 | neomutt | 20200619+dfsg.1-1 |
| Debian 8 | mutt | 1.5.23-3+deb8u2 |
| Debian 8 | mutt | 1.5.23-3+deb8u3 |
| Debian 9 | mutt | 1.7.2-1+deb9u3 |
| SUSE Enterprise Storage 5 | mutt | 1.10.1-55.11.1 |
| SUSE HPE Helion OpenStack 8 | mutt | 1.10.1-55.11.1 |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | mutt | 1.10.1-3.8.1 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | mutt | 1.10.1-3.8.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | mutt | 1.10.1-3.8.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP2 | mutt | 1.10.1-3.8.1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | mutt | 1.5.17-42.51.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | mutt | 1.5.17-42.51.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | mutt | 1.10.1-55.11.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | mutt | 1.10.1-55.11.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | mutt | 1.10.1-55.11.1 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | mutt | 1.10.1-55.11.1 |
| SUSE Linux Enterprise Server 12 SP4 | mutt | 1.10.1-55.11.1 |
| SUSE Linux Enterprise Server 12 SP5 | mutt | 1.10.1-55.11.1 |
| SUSE Linux Enterprise Server 15-LTSS | mutt | 1.10.1-3.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | mutt | 1.10.1-55.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | mutt | 1.10.1-55.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | mutt | 1.10.1-55.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | mutt | 1.10.1-55.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 | mutt | 1.10.1-3.8.1 |
| SUSE OpenStack Cloud 7 | mutt | 1.10.1-55.11.1 |
| SUSE OpenStack Cloud 8 | mutt | 1.10.1-55.11.1 |
| SUSE OpenStack Cloud Crowbar 8 | mutt | 1.10.1-55.11.1 |
| SUSE Package Hub 15 SP1 | neomutt | 20201120-bp151.3.3.1 |
| SUSE Package Hub 15 SP2 | neomutt | 20201120-bp152.2.3.1 |
| Ubuntu 16.04 LTS | mutt | 1.5.24-1ubuntu0.4 |
| Ubuntu 18.04 LTS | mutt | 1.9.4-3ubuntu0.3 |
| Ubuntu 20.04 LTS | mutt | 1.13.2-1ubuntu0.2 |
| Ubuntu Pro 18.04 LTS | neomutt | 20171215+dfsg.1-1ubuntu0.1~esm1 |
| Ubuntu Pro 20.04 LTS | neomutt | 20191207+dfsg.1-1.1ubuntu0.1~esm1 |
| Ubuntu Pro 22.04 LTS | neomutt | 20211029+dfsg1-1ubuntu0.1~esm1 |
| Ubuntu Pro 24.04 LTS | neomutt | 20231103+dfsg1-1ubuntu0.1~esm1 |
| openSUSE Leap 15.1 | mutt | 1.10.1-lp151.2.3.1 |
| openSUSE Leap 15.1 | neomutt | 20201120-lp152.2.3.1 |
| openSUSE Leap 15.2 | mutt | 1.10.1-lp152.3.3.1 |
| openSUSE Leap 15.2 | neomutt | 20201120-lp152.2.3.1 |
| openSUSE Tumbleweed | mutt | 2.0.7-2.2 |
| openSUSE Tumbleweed | neomutt | 20210205-3.3 |