CVE-2020-14954 Other in n/a
A man-in-the-middle attacker can inject data into the TLS handshake of Mutt or NeoMutt, potentially bypassing security checks or exposing information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-14954?
CVE-2020-14954 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 21 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."
Weakness: CWE-74
Which versions are affected by CVE-2020-14954?
It affects 6 products.
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Mutt Mutt, Neomutt Neomutt, Opensuse Leap.
How do I fix CVE-2020-14954?
Upgrade to a fixed version.
Is CVE-2020-14954 being exploited?
There is no known exploitation of CVE-2020-14954 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2020-14954, GHSA-fv44-9w74-ffg5, OESA-2022-1561, UBUNTU-CVE-2020-14954, USN-4403-1.