Fedora: Security Advisory for curl (FEDORA-2021-5d21b90a30)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

An issue was discovered in Ruby through 2.6.7 2.7.x through 2.7.3 and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command aka a "StartTLS stripping attack."

...

CVE-2021-38372

In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38370

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38370

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...

Design/Logic Flaw

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38370

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38372

In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS...

Code injection

In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS...

UBUNTU-CVE-2021-38370

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38372

In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38372

In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38372

CVE-2021-38372 affects KDE Trojita 0.7. The issue arises because untagged IMAP responses are accepted before STARTTLS, enabling man-in-the-middle attackers to create new folders. Root cause stated as untagged responses being processed prior to STARTTLS. No exploitation details or patch/version in...

CVE-2021-38370

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38370

The CVE describes Alpine before 2.25 allowing untagged IMAP responses before STARTTLS, potentially leaking information. Affected component: Alpine IMAP handling. Root cause: insecure handling of IMAP responses prior to TLS upgrade. Impact per sources: information leakage (and related issues) when...

PT-2021-22086

Name of the Vulnerable Software and Affected Versions KDE Trojita version 0.7 Description Man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS. Recommendations For KDE Trojita version 0.7, consider disabling the acceptance ...

PT-2021-22085

Name of the Vulnerable Software and Affected Versions Alpine versions prior to 2.25 Description The issue concerns the acceptance of untagged responses from an IMAP server before STARTTLS. This indicates a potential security risk related to the handling of server responses during the initial...

CVE-2021-38370: Improper Neutralization of Special Elements used in a Command

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38372: Improper Neutralization of Special Elements used in a Command

In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38370

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...