fetchmail vulnerability

Releases

• Ubuntu 6.10
• Ubuntu 6.06
• Ubuntu 5.10

Details

It was discovered that fetchmail did not correctly require TLS
negotiation in certain situations. This would result in a user’s
unencrypted password being sent across the network.

If fetchmail has been configured to use the “sslproto tls1”,
“sslcertck”, or “sslfingerprint” options with a server that does not
correctly support TLS negotiation, this update may cause fetchmail to
(correctly) abort authentication.