CVE-2020-15917
Fixed in a distro release EPSS 3%
common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.
Products: claws-mail, fedoraproject fedora, opensuse backports_sle, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | claws-mail | 3.17.6-1 |
| Debian 13 | claws-mail | 3.17.6-1 |
| Debian 14 | claws-mail | 3.17.6-1 |
| SUSE Package Hub 15 SP1 | claws-mail | 3.17.8-bp152.3.6.1 |
| SUSE Package Hub 15 SP1 | claws-mail | 3.17.3-bp151.3.3.1 |
| SUSE Package Hub 15 SP2 | claws-mail | 3.18.0-bp153.2.3.1 |
| SUSE Package Hub 15 SP2 | claws-mail | 3.17.8-bp152.3.6.1 |
| SUSE Package Hub 15 SP2 | claws-mail | 3.17.6-bp152.3.3.1 |
| SUSE Package Hub 15 SP3 | claws-mail | 3.18.0-bp153.2.3.1 |
| Ubuntu 16.04 LTS | claws-mail | no fix |
| Ubuntu 18.04 LTS | claws-mail | no fix |
| Ubuntu 20.04 LTS | claws-mail | no fix |
| openSUSE Leap 15.1 | claws-mail | 3.17.8-bp152.3.6.1 |
| openSUSE Leap 15.1 | claws-mail | 3.17.3-lp151.2.3.1 |
| openSUSE Leap 15.2 | claws-mail | 3.17.8-bp152.3.6.1 |
| openSUSE Leap 15.2 | claws-mail | 3.18.0-bp153.2.3.1 |
| openSUSE Leap 15.2 | claws-mail | 3.17.6-lp152.3.3.1 |
| openSUSE Leap 15.3 | claws-mail | 3.18.0-bp153.2.3.1 |
| openSUSE Tumbleweed | claws-mail | 4.0.0-2.5 |