Date: Thu, 25 Jun 2020 12:05:03 +0200 From: Jan Kundrát <jkt@....org> To: <oss-security@...ts.openwall.com> Cc: <security@....org> Subject: Requesting a CVE id for Trojitá, an e-mail client: Improper Certificate Validation Hi folks, I would appreciate a Cc on responses as I'm not subscribed to this list. I would like to request a CVE for the following vulnerability: Summary ------- Damian Poddebniak discovered a TLS verification failure (CWE-295) in Trojitá , a fast Qt IMAP e-mail client. When sending e-mails over SMTP, all TLS errors were ignored. Background ---------- Trojita first gained support for SMTP submission in patch 0083eea5ed . Since that commit (May 2009), there's been a FIXME comment in the code that SSL errors should be handled properly. Unfortunately, this issue kept falling through the cracks and we never re-enabled TLS validation as the SMTP backend matured. As a result, outgoing SMTP connections were suspectible to a MITM attack, with authentication details including passwords and the message content potentially available to attackers. IMAP connections are not suspectible to this bug. Affected versions ----------------- All versions of Trojita up to and including v0.7 are affected. The fix  will be included in version v0.8 which will be released once the CVE gets assigned. Acknowledgement --------------- Thanks to Damian Poddebniak for reporting  this bug.  http://trojita.flaska.net/  https://invent.kde.org/pim/trojita/-/commit/0083eea5ed  https://gerrit.vesnicky.cesnet.cz/r/1035  https://bugs.kde.org/show_bug.cgi?id=423453 With kind regards, Jan -- Trojitá, a fast Qt IMAP e-mail client -- http://trojita.flaska.net/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.