Security update for mutt SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:3568-1 Final 1 1 2020-11-30T15:59:08Z current 2020-11-30T15:59:08Z 2020-11-30T15:59:08Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for mutt This update for mutt fixes the following issues: - CVE-2020-28896: incomplete connection termination could lead to sending credentials over unencrypted connections (bsc#1179035) - Avoid that message with a million tiny parts can freeze MUA for several minutes (bsc#1179113) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-3568,SUSE-SLE-Module-Basesystem-15-SP1-2020-3568,SUSE-SLE-Module-Basesystem-15-SP2-2020-3568,SUSE-SLE-Module-Basesystem-15-SP3-2020-3568,SUSE-SLE-Product-HPC-15-2020-3568,SUSE-SLE-Product-SLES-15-2020-3568,SUSE-SLE-Product-SLES_SAP-15-2020-3568 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20203568-1/ Link for SUSE-SU-2020:3568-1 https://lists.suse.com/pipermail/sle-security-updates/2020-November/007891.html E-Mail link for SUSE-SU-2020:3568-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1179035 SUSE Bug 1179035 https://bugzilla.suse.com/1179113 SUSE Bug 1179113 https://www.suse.com/security/cve/CVE-2020-28896/ SUSE CVE CVE-2020-28896 page SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP Applications 15 mutt-1.10.1-3.11.1 mutt-doc-1.10.1-3.11.1 mutt-lang-1.10.1-3.11.1 mutt-1.10.1-3.11.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS mutt-doc-1.10.1-3.11.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS mutt-lang-1.10.1-3.11.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS mutt-1.10.1-3.11.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS mutt-doc-1.10.1-3.11.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS mutt-lang-1.10.1-3.11.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS mutt-1.10.1-3.11.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 mutt-doc-1.10.1-3.11.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 mutt-lang-1.10.1-3.11.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 mutt-1.10.1-3.11.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 mutt-doc-1.10.1-3.11.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 mutt-lang-1.10.1-3.11.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 mutt-1.10.1-3.11.1 as a component of SUSE Linux Enterprise Server 15-LTSS mutt-doc-1.10.1-3.11.1 as a component of SUSE Linux Enterprise Server 15-LTSS mutt-lang-1.10.1-3.11.1 as a component of SUSE Linux Enterprise Server 15-LTSS mutt-1.10.1-3.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 mutt-doc-1.10.1-3.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 mutt-lang-1.10.1-3.11.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle. CVE-2020-28896 SUSE Linux Enterprise High Performance Computing 15-ESPOS:mutt-1.10.1-3.11.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:mutt-doc-1.10.1-3.11.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:mutt-lang-1.10.1-3.11.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:mutt-1.10.1-3.11.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:mutt-doc-1.10.1-3.11.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:mutt-lang-1.10.1-3.11.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:mutt-1.10.1-3.11.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:mutt-doc-1.10.1-3.11.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:mutt-lang-1.10.1-3.11.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:mutt-1.10.1-3.11.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:mutt-doc-1.10.1-3.11.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:mutt-lang-1.10.1-3.11.1 SUSE Linux Enterprise Server 15-LTSS:mutt-1.10.1-3.11.1 SUSE Linux Enterprise Server 15-LTSS:mutt-doc-1.10.1-3.11.1 SUSE Linux Enterprise Server 15-LTSS:mutt-lang-1.10.1-3.11.1 SUSE Linux Enterprise Server for SAP Applications 15:mutt-1.10.1-3.11.1 SUSE Linux Enterprise Server for SAP Applications 15:mutt-doc-1.10.1-3.11.1 SUSE Linux Enterprise Server for SAP Applications 15:mutt-lang-1.10.1-3.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203568-1/ https://www.suse.com/security/cve/CVE-2020-28896.html CVE-2020-28896 https://bugzilla.suse.com/1179035 SUSE Bug 1179035