Bug 728300 (CVE-2020-14093, CVE-2020-14154)

Summary:	[Tracker] Mutt mishandling of TLS (CVE-2020-{14093,14154})
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---
Bug Depends on:	728294, 728302
Bug Blocks:	807352

Description Sam James archtester

2020-06-14 22:58:30 UTC

1) A possible IMAP man-in-the-middle attack.  No credentials 
are exposed, but could result in unintended emails being "saved" to an 
attacker's server.  The $ssl_starttls quadoption is now used to check 
for an unencrypted PREAUTH response from the server.


2) A problem with GnuTLS certificate prompting. "Rejecting" an expired intermediate cert did not terminate the 
connection.