CVE-2019-8337 Security feature bypass in n/a
Attackers can bypass TLS certificate verification in msmtp and mpop when using default settings, enabling man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-8337?
CVE-2019-8337 is a medium-severity vulnerability in n/a, published on 13 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In msmtp 1.8.2 and mpop 1.4.3, when tls_trust_file has its default configuration, certificate-verification results are not properly checked.
Weakness: CWE-295
Which versions are affected by CVE-2019-8337?
It affects 2 products.
Linux distribution packages (1)
mstmp openSUSE:Tumbleweed | All versions | 1.8.16-1.1 |
Products include Marlam Mpop, Marlam Msmtp.
How do I fix CVE-2019-8337?
Upgrade to a fixed version.
Is CVE-2019-8337 being exploited?
There is no known exploitation of CVE-2019-8337 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2019-8337, GHSA-84ww-gp3p-3hmw, UBUNTU-CVE-2019-8337, openSUSE-SU-2024:11064-1.