Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2020-14954: Mutt and NeoMutt can be tricked during TLS handshake
CVE-2020-14954 · published 6 years ago
Summary
The email programs Mutt (versions before 1.14.4) and NeoMutt (versions before June 2020) may read extra data that a server sends when TLS encryption is started. An attacker who can insert themselves in the network could cause the client to process that extra data as if it were part of the secure connection, potentially leading to malicious commands being executed. Upgrade to the latest versions of Mutt and NeoMutt or apply any security patches provided by your distribution.
What to do
- Update debian mutt to version 1.14.4-1.
- Update debian neomutt to version 20200619+dfsg.1-1.
- Update mutt mutt to version 1.14.4 or later.
- Update neomutt neomutt to version 20200619 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | mutt |
< 1.14.4-1 Fix: upgrade to 1.14.4-1
|
| Debian:13 | debian | mutt |
< 1.14.4-1 Fix: upgrade to 1.14.4-1
|
| Debian:14 | debian | mutt |
< 1.14.4-1 Fix: upgrade to 1.14.4-1
|
| Debian:12 | debian | neomutt |
< 20200619+dfsg.1-1 Fix: upgrade to 20200619+dfsg.1-1
|
| Debian:13 | debian | neomutt |
< 20200619+dfsg.1-1 Fix: upgrade to 20200619+dfsg.1-1
|
| Debian:14 | debian | neomutt |
< 20200619+dfsg.1-1 Fix: upgrade to 20200619+dfsg.1-1
|
| – | mutt | mutt |
< 1.14.4 cpe:2.3:a:mutt:mutt:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
9.0 10.0 8.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| – | neomutt | neomutt |
< 20200619 cpe:2.3:a:neomutt:neomutt:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
31 32 cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
12.04 16.04 18.04 19.10 20.04 cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* |
| – | opensuse | leap |
15.1 15.2 cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* |
Original advisory text
Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g...
Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."
References
- https://security-tracker.debian.org/tracker/CVE-2020-14954 Vendor Advisory
- http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20200615/000023.html Mailing List Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00064.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00070.html Third Party Advisory
- http://www.mutt.org/ Product
- https://github.com/neomutt/neomutt/commit/fb013ec666759cb8a9e294347c7b4c1f597639... Patch
- https://github.com/neomutt/neomutt/releases/tag/20200619 Release Notes
- https://gitlab.com/muttmua/mutt/-/commit/c547433cdf2e79191b15c6932c57f1472bfb5ff... Patch
- https://gitlab.com/muttmua/mutt/-/issues/248 Issue Tracking Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/06/msg00039.html Mailing List Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/06/msg00040.html Mailing List Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://security.gentoo.org/glsa/202007-57 Third Party Advisory
- https://usn.ubuntu.com/4403-1/ Third Party Advisory
- https://www.debian.org/security/2020/dsa-4707 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4708 Third Party Advisory
Severity
5.9
Medium
Type
CWE-74Injection
Timeline
Published21 Jun 2020
Updated29 Oct 2026
First seen11 Sep 2026
Track software like this
Free during beta