ArchLinuxASA-201902-22[ASA-201902-22] msmtp: certificate verification bypass
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS
Percentile
46.9%
Arch Linux Security Advisory ASA-201902-22
Severity: High
Date : 2019-02-17
CVE-ID : CVE-2019-8337
Package : msmtp
Type : certificate verification bypass
Remote : Yes
Link : https://security.archlinux.org/AVG-905
Summary
The package msmtp before version 1.8.3-1 is vulnerable to certificate
verification bypass.
Resolution
Upgrade to 1.8.3-1.
pacman -Syu “msmtp>=1.8.3-1”
The problem has been fixed upstream in version 1.8.3.
Workaround
None.
Description
In msmtp 1.8.2, when tls_trust_file has its default configuration,
certificate-verification results are not properly checked.
Impact
The default configuration would omit certification verification.
References
https://marlam.de/msmtp/news/
https://gitlab.marlam.de/marlam/msmtp/commit/a81d0a5126304f9f8b29a75d058044dc67d07663
https://security.archlinux.org/CVE-2019-8337
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS
Percentile
46.9%