Security update for mutt SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:3632-1 Final 1 1 2020-12-07T10:50:59Z current 2020-12-07T10:50:59Z 2020-12-07T10:50:59Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for mutt This update for mutt fixes the following issues: - Find and display the content of messages properly. (bsc#1179461) - CVE-2020-28896: incomplete connection termination could send credentials over unencrypted connections. (bsc#1179035) - Avoid that message with a million tiny parts can freeze MUA for several minutes. (bsc#1179113) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). HPE-Helion-OpenStack-8-2020-3632,Image SLES12-SP4-SAP-Azure-2020-3632,Image SLES12-SP4-SAP-Azure-BYOS-2020-3632,Image SLES12-SP4-SAP-Azure-LI-BYOS-Production-2020-3632,Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production-2020-3632,Image SLES12-SP4-SAP-EC2-HVM-2020-3632,Image SLES12-SP4-SAP-EC2-HVM-BYOS-2020-3632,Image SLES12-SP4-SAP-GCE-2020-3632,Image SLES12-SP4-SAP-GCE-BYOS-2020-3632,Image SLES12-SP4-SAP-OCI-BYOS-2020-3632,Image SLES12-SP5-Azure-SAP-BYOS-2020-3632,Image SLES12-SP5-Azure-SAP-On-Demand-2020-3632,Image SLES12-SP5-EC2-SAP-BYOS-2020-3632,Image SLES12-SP5-EC2-SAP-On-Demand-2020-3632,Image SLES12-SP5-GCE-SAP-BYOS-2020-3632,Image SLES12-SP5-GCE-SAP-On-Demand-2020-3632,Image SLES12-SP5-OCI-BYOS-SAP-BYOS-2020-3632,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2020-3632,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2020-3632,SUSE-2020-3632,SUSE-OpenStack-Cloud-7-2020-3632,SUSE-OpenStack-Cloud-8-2020-3632,SUSE-OpenStack-Cloud-9-2020-3632,SUSE-OpenStack-Cloud-Crowbar-8-2020-3632,SUSE-OpenStack-Cloud-Crowbar-9-2020-3632,SUSE-SLE-SAP-12-SP2-2020-3632,SUSE-SLE-SAP-12-SP3-2020-3632,SUSE-SLE-SAP-12-SP4-2020-3632,SUSE-SLE-SERVER-12-SP2-2020-3632,SUSE-SLE-SERVER-12-SP2-BCL-2020-3632,SUSE-SLE-SERVER-12-SP3-2020-3632,SUSE-SLE-SERVER-12-SP3-BCL-2020-3632,SUSE-SLE-SERVER-12-SP4-LTSS-2020-3632,SUSE-SLE-SERVER-12-SP5-2020-3632,SUSE-Storage-5-2020-3632 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20203632-1/ Link for SUSE-SU-2020:3632-1 https://lists.suse.com/pipermail/sle-security-updates/2020-December/007921.html E-Mail link for SUSE-SU-2020:3632-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1179035 SUSE Bug 1179035 https://bugzilla.suse.com/1179113 SUSE Bug 1179113 https://bugzilla.suse.com/1179461 SUSE Bug 1179461 https://www.suse.com/security/cve/CVE-2020-28896/ SUSE CVE CVE-2020-28896 page HPE Helion OpenStack 8 Image SLES12-SP4-SAP-Azure Image SLES12-SP4-SAP-Azure-BYOS Image SLES12-SP4-SAP-Azure-LI-BYOS-Production Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production Image SLES12-SP4-SAP-EC2-HVM Image SLES12-SP4-SAP-EC2-HVM-BYOS Image SLES12-SP4-SAP-GCE Image SLES12-SP4-SAP-GCE-BYOS Image SLES12-SP4-SAP-OCI-BYOS Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-OCI-BYOS-SAP-BYOS Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Enterprise Storage 5 SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP3-BCL SUSE Linux Enterprise Server 12 SP3-LTSS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE OpenStack Cloud 7 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 mutt-1.10.1-55.18.1 mutt-1.10.1-55.18.1 as a component of HPE Helion OpenStack 8 mutt-1.10.1-55.18.1 as a component of Image SLES12-SP4-SAP-Azure mutt-1.10.1-55.18.1 as a component of Image SLES12-SP4-SAP-Azure-BYOS mutt-1.10.1-55.18.1 as a component of Image SLES12-SP4-SAP-Azure-LI-BYOS-Production mutt-1.10.1-55.18.1 as a component of Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production mutt-1.10.1-55.18.1 as a component of Image SLES12-SP4-SAP-EC2-HVM mutt-1.10.1-55.18.1 as a component of Image SLES12-SP4-SAP-EC2-HVM-BYOS mutt-1.10.1-55.18.1 as a component of Image SLES12-SP4-SAP-GCE mutt-1.10.1-55.18.1 as a component of Image SLES12-SP4-SAP-GCE-BYOS mutt-1.10.1-55.18.1 as a component of Image SLES12-SP4-SAP-OCI-BYOS mutt-1.10.1-55.18.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS mutt-1.10.1-55.18.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand mutt-1.10.1-55.18.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS mutt-1.10.1-55.18.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand mutt-1.10.1-55.18.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS mutt-1.10.1-55.18.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand mutt-1.10.1-55.18.1 as a component of Image SLES12-SP5-OCI-BYOS-SAP-BYOS mutt-1.10.1-55.18.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production mutt-1.10.1-55.18.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production mutt-1.10.1-55.18.1 as a component of SUSE Enterprise Storage 5 mutt-1.10.1-55.18.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL mutt-1.10.1-55.18.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS mutt-1.10.1-55.18.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL mutt-1.10.1-55.18.1 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS mutt-1.10.1-55.18.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS mutt-1.10.1-55.18.1 as a component of SUSE Linux Enterprise Server 12 SP5 mutt-1.10.1-55.18.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 mutt-1.10.1-55.18.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 mutt-1.10.1-55.18.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 mutt-1.10.1-55.18.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 mutt-1.10.1-55.18.1 as a component of SUSE OpenStack Cloud 7 mutt-1.10.1-55.18.1 as a component of SUSE OpenStack Cloud 8 mutt-1.10.1-55.18.1 as a component of SUSE OpenStack Cloud 9 mutt-1.10.1-55.18.1 as a component of SUSE OpenStack Cloud Crowbar 8 mutt-1.10.1-55.18.1 as a component of SUSE OpenStack Cloud Crowbar 9 Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle. CVE-2020-28896 HPE Helion OpenStack 8:mutt-1.10.1-55.18.1 Image SLES12-SP4-SAP-Azure-BYOS:mutt-1.10.1-55.18.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:mutt-1.10.1-55.18.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:mutt-1.10.1-55.18.1 Image SLES12-SP4-SAP-Azure:mutt-1.10.1-55.18.1 Image SLES12-SP4-SAP-EC2-HVM-BYOS:mutt-1.10.1-55.18.1 Image SLES12-SP4-SAP-EC2-HVM:mutt-1.10.1-55.18.1 Image SLES12-SP4-SAP-GCE-BYOS:mutt-1.10.1-55.18.1 Image SLES12-SP4-SAP-GCE:mutt-1.10.1-55.18.1 Image SLES12-SP4-SAP-OCI-BYOS:mutt-1.10.1-55.18.1 Image SLES12-SP5-Azure-SAP-BYOS:mutt-1.10.1-55.18.1 Image SLES12-SP5-Azure-SAP-On-Demand:mutt-1.10.1-55.18.1 Image SLES12-SP5-EC2-SAP-BYOS:mutt-1.10.1-55.18.1 Image SLES12-SP5-EC2-SAP-On-Demand:mutt-1.10.1-55.18.1 Image SLES12-SP5-GCE-SAP-BYOS:mutt-1.10.1-55.18.1 Image SLES12-SP5-GCE-SAP-On-Demand:mutt-1.10.1-55.18.1 Image SLES12-SP5-OCI-BYOS-SAP-BYOS:mutt-1.10.1-55.18.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:mutt-1.10.1-55.18.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:mutt-1.10.1-55.18.1 SUSE Enterprise Storage 5:mutt-1.10.1-55.18.1 SUSE Linux Enterprise Server 12 SP2-BCL:mutt-1.10.1-55.18.1 SUSE Linux Enterprise Server 12 SP2-LTSS:mutt-1.10.1-55.18.1 SUSE Linux Enterprise Server 12 SP3-BCL:mutt-1.10.1-55.18.1 SUSE Linux Enterprise Server 12 SP3-LTSS:mutt-1.10.1-55.18.1 SUSE Linux Enterprise Server 12 SP4-LTSS:mutt-1.10.1-55.18.1 SUSE Linux Enterprise Server 12 SP5:mutt-1.10.1-55.18.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:mutt-1.10.1-55.18.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:mutt-1.10.1-55.18.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:mutt-1.10.1-55.18.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:mutt-1.10.1-55.18.1 SUSE OpenStack Cloud 7:mutt-1.10.1-55.18.1 SUSE OpenStack Cloud 8:mutt-1.10.1-55.18.1 SUSE OpenStack Cloud 9:mutt-1.10.1-55.18.1 SUSE OpenStack Cloud Crowbar 8:mutt-1.10.1-55.18.1 SUSE OpenStack Cloud Crowbar 9:mutt-1.10.1-55.18.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203632-1/ https://www.suse.com/security/cve/CVE-2020-28896.html CVE-2020-28896 https://bugzilla.suse.com/1179035 SUSE Bug 1179035