Vulnerability CVE-2020-15953: Information

Description

LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."

Severity: HIGH (7.4)

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: MEDIUM (5.8)

Vector: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2020-15953

Published: July 27, 2020

Modified: Nov. 21, 2024

Error type identifier: CWE-74

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
libetpan	sisyphus	1.9.4-alt2	1.9.4-alt6	ALT-PU-2020-2908-1	259052	Fixed
libetpan	sisyphus_e2k	1.9.4-alt4	1.9.4-alt6	ALT-PU-2023-7033-1	-	Fixed
libetpan	sisyphus_riscv64	1.9.4-alt4	1.9.4-alt6	ALT-PU-2023-7113-1	-	Fixed
libetpan	p11	1.9.4-alt2	1.9.4-alt6	ALT-PU-2020-2908-1	259052	Fixed
libetpan	p10	1.9.4-alt4	1.9.4-alt4	ALT-PU-2023-7017-2	333836	Fixed
libetpan	p10_e2k	1.9.4-alt4	1.9.4-alt4	ALT-PU-2023-7456-1	-	Fixed
libetpan	p9	1.9.4-alt2	1.9.4-alt4	ALT-PU-2020-2942-1	259053	Fixed
libetpan	c10f2	1.9.4-alt4	1.9.4-alt4	ALT-PU-2023-7178-2	334309	Fixed
libetpan	c9f2	1.9.4-alt4	1.9.4-alt4	ALT-PU-2023-7051-3	333922	Fixed

References to Advisories, Solutions, and Tools

Hyperlink	Resource
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00060.html	Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00075.html	Broken Link
https://github.com/dinhvh/libetpan/issues/386	Exploit Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/08/msg00026.html	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M65FVH5XPS23NLHFN3ABEGBSCHZAISXN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QFBWNA5REI5ZGW2DAOEAVHM23MOU6O5J/
https://security.gentoo.org/glsa/202007-55	Third Party Advisory

Affected configurations:
1. cpe:2.3:a:libetpan_project:libetpan:*:*:*:*:*:*:*:*
  End including
  1.9.4
  cpe:2.3:a:libmailcore:mailcore2:*:*:*:*:*:*:*:*
  End including
  0.6.3
  cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
  cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
  cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Version: v26.2.2