Security update for mutt
SUSE Security Update: Security update for muttAnnouncement ID: | SUSE-SU-2020:14414-1 |
Rating: | important |
References: | #1172906 #1172935 #1173197 |
Cross-References: | CVE-2020-14093 CVE-2020-14154 CVE-2020-14954 |
Affected Products: |
|
An update that fixes three vulnerabilities is now available.
Description:
This update for mutt fixes the following issues:
- CVE-2020-14954: Fixed a response injection due to a STARTTLS buffering issue which was affecting IMAP, SMTP, and POP3 (bsc#1173197).
- CVE-2020-14093: Fixed a potential IMAP Man-in-the-Middle attack via a PREAUTH response (bsc#1172906, bsc#1172935).
- CVE-2020-14154: Fixed an issue where Mutt was ignoring an expired certificate and was proceeding with a connection (bsc#1172906, bsc#1172935).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 11-SP4-LTSS:
zypper in -t patch slessp4-mutt-14414=1
- SUSE Linux Enterprise Point of Sale 11-SP3:
zypper in -t patch sleposp3-mutt-14414=1
- SUSE Linux Enterprise Debuginfo 11-SP4:
zypper in -t patch dbgsp4-mutt-14414=1
- SUSE Linux Enterprise Debuginfo 11-SP3:
zypper in -t patch dbgsp3-mutt-14414=1
Package List:
- SUSE Linux Enterprise Server 11-SP4-LTSS (i586 ppc64 s390x x86_64):
- mutt-1.5.17-42.51.1
- SUSE Linux Enterprise Point of Sale 11-SP3 (i586):
- mutt-1.5.17-42.51.1
- SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ppc64 s390x x86_64):
- mutt-debuginfo-1.5.17-42.51.1
- mutt-debugsource-1.5.17-42.51.1
- SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64):
- mutt-debuginfo-1.5.17-42.51.1
- mutt-debugsource-1.5.17-42.51.1