Bug 734328 (CVE-2020-16094)

Summary:	<mail-client/claws-mail-3.17.7: Denial of service (unbounded recursion) via IMAP folder structure (CVE-2020-16094)
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	polynomial-c
Priority:	Normal	Keywords:	CC-ARCHES, STABLEREQ
Version:	unspecified	Flags:	nattka: sanity-check+
Hardware:	All
OS:	Linux
URL:	https://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=4313
Whiteboard:	B3 [noglsa cve]
Package list:	mail-client/claws-mail-3.17.7	Runtime testing required:	---

Description Sam James archtester

2020-07-28 21:43:52 UTC

Description:
"In imap_scan_tree_recursive in Claws Mail through 3.17.6, a malicious IMAP server can trigger stack consumption because of unlimited recursion into subdirectories during a rebuild of the folder tree."

Comment 1 Sam James archtester

2020-11-16 18:53:56 UTC

Ready to stable?

Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev

2020-11-17 21:03:29 UTC

x86 stable

Comment 3 Sam James archtester

2020-11-18 09:54:30 UTC

amd64 done

all arches done

Comment 4 Sam James archtester

2020-11-18 09:54:44 UTC

Please cleanup, thanks!

Comment 5 Larry the Git Cow gentoo-dev

2020-11-18 10:32:20 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6a6b05206955fbc2ed8926c9b09f7cfdaca79b6b

commit 6a6b05206955fbc2ed8926c9b09f7cfdaca79b6b
Author:     Lars Wendler <polynomial-c@gentoo.org>
AuthorDate: 2020-11-18 10:32:14 +0000
Commit:     Lars Wendler <polynomial-c@gentoo.org>
CommitDate: 2020-11-18 10:32:14 +0000

    mail-client/claws-mail: Security cleanup
    
    Bug: https://bugs.gentoo.org/734328
    Package-Manager: Portage-3.0.9, Repoman-3.0.2
    Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>

 mail-client/claws-mail/Manifest                    |   1 -
 mail-client/claws-mail/claws-mail-3.17.6-r1.ebuild | 215 ---------------------
 2 files changed, 216 deletions(-)