CVE-2021-39272

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH...

Session fixation

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH...

CVE-2021-39272

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH...

CVE-2021-39272

Fetchmail prior to version 6.4.22 is vulnerable to STARTTLS encryption bypass in certain IMAP/PREAUTH scenarios. Multiple sources (Alpine Linux, Debian security tracker, CVE listing, and related advisories) confirm that upgrading to 6.4.22 or newer resolves this issue. The affected package is fet...

CVE-2021-39272

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH...

CVE-2021-39272

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH...

The vulnerability in the implementation of the Net::IMAP class in the Ruby interpreter allows a attacker to execute a “man-in-the-middle” attack.

The vulnerability in the implementation of the Net::IMAP class in the Ruby interpreter is related to errors in the process of verifying the authenticity of certificates when processing the STARTTLS command. Exploiting this vulnerability could allow a remote attacker to execute a “man-in-the-middl...

Mozilla Thunderbird Command Injection Vulnerability

Mozilla Thunderbird is an open source email client. A command injection vulnerability exists in the Mozilla Thunderbird product, which stems from a problem in the way Thunderbird handles IMAP server responses sent prior to the STARTTLS process. An attacker could exploit this vulnerability to send...

Dozens of STARTTLS Related Flaws Found Affecting Popular Email Clients

Security researchers have disclosed as many as 40 different vulnerabilities associated with an opportunistic encryption mechanism in mail clients and servers that could open the door to targeted man-in-the-middle MitM attacks, permitting an intruder to forge mailbox content and steal credentials...

Fedora: Security Advisory for curl (FEDORA-2021-5d21b90a30)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

An issue was discovered in Ruby through 2.6.7 2.7.x through 2.7.3 and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command aka a "StartTLS stripping attack."

...

CVE-2021-38372

In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38370

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38370

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38372

In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS...

Code injection

In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38370

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...

UBUNTU-CVE-2021-38370

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...

Design/Logic Flaw

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38372

CVE-2021-38372 affects KDE Trojita 0.7. The issue arises because untagged IMAP responses are accepted before STARTTLS, enabling man-in-the-middle attackers to create new folders. Root cause stated as untagged responses being processed prior to STARTTLS. No exploitation details or patch/version in...