CVE-2020-15917
common/session.c in Claws Mail before 3.17.6 has a protocol violation ...
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD.
Description
common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.12 | claws-mail | 3.17.6-r0 |
| alpine 3.13 | claws-mail | 3.17.6-r0 |
| alpine 3.14 | claws-mail | 3.17.6-r0 |
| alpine 3.15 | claws-mail | 3.17.6-r0 |
| alpine 3.16 | claws-mail | 3.17.6-r0 |
| alpine 3.17 | claws-mail | 3.17.6-r0 |
| alpine 3.18 | claws-mail | 3.17.6-r0 |
| alpine 3.19 | claws-mail | 3.17.6-r0 |
| alpine 3.20 | claws-mail | 3.17.6-r0 |
| alpine 3.21 | claws-mail | 3.17.6-r0 |
| alpine 3.22 | claws-mail | 3.17.6-r0 |
| alpine 3.23 | claws-mail | 3.17.6-r0 |
Show all 21 entries from 21 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.12 | claws-mail | 3.17.6-r0 |
| alpine 3.13 | claws-mail | 3.17.6-r0 |
| alpine 3.14 | claws-mail | 3.17.6-r0 |
| alpine 3.15 | claws-mail | 3.17.6-r0 |
| alpine 3.16 | claws-mail | 3.17.6-r0 |
| alpine 3.17 | claws-mail | 3.17.6-r0 |
| alpine 3.18 | claws-mail | 3.17.6-r0 |
| alpine 3.19 | claws-mail | 3.17.6-r0 |
| alpine 3.20 | claws-mail | 3.17.6-r0 |
| alpine 3.21 | claws-mail | 3.17.6-r0 |
| alpine 3.22 | claws-mail | 3.17.6-r0 |
| alpine 3.23 | claws-mail | 3.17.6-r0 |
| alpine 3.24 | claws-mail | 3.17.6-r0 |
| alpine edge | claws-mail | 3.17.6-r0 |
| debian 10 | claws-mail | no fix listed |
| debian 11 | claws-mail | 3.17.6-1 |
| debian 12 | claws-mail | 3.17.6-1 |
| debian 13 | claws-mail | 3.17.6-1 |
| debian 14 | claws-mail | 3.17.6-1 |
| debian 9 | claws-mail | no fix listed |
| echo | claws-mail | 3.17.6-1 |
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00090.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00060.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00051.html
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00013.html
- https://git.claws-mail.org/?p=claws.git%3Ba=blob%3Bf=RELEASE_NOTES
- https://git.claws-mail.org/?p=claws.git%3Ba=commit%3Bh=fcc25329049b6f9bd8d890f1197ed61eb12e14d5
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6YVQB7NRBHO67Q74RS7RZCMW4ENRVBB4/