search

flathub / org.claws_mail.Claws-Mail

https://flathub.org/apps/details/org.claws_mail.Claws-Mail
4 stars 1 forks source link

Upgrade libetpan to fix CVE without introducing crashes #22

Closed cobratbq closed 3 years ago

cobratbq commented 3 years ago

libetpan suffers from CVE-2020-15953, see issue https://github.com/dinhvh/libetpan/issues/386.

LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."

This is fixed with PRs https://github.com/dinhvh/libetpan/pull/387 and https://github.com/dinhvh/libetpan/pull/388, but never officially released. In addition, the latest state of the master branch of libetpan causes crashes: #18.

cobratbq commented 3 years ago

See also https://therecord.media/starttls-implementations-in-email-clients-servers-plagued-by-40-vulnerabilities/