svn commit: r555985 - head/security/vuxml
Thomas Zander
riggs at FreeBSD.org
Sat Nov 21 14:41:34 UTC 2020
Author: riggs
Date: Sat Nov 21 14:41:33 2020
New Revision: 555985
URL: https://svnweb.freebsd.org/changeset/ports/555985
Log:
Document CVE-2020-28896 for mutt 2.0.2.
PR: 251278
Submitted by: dereks at lifeofadishwasher.com
Security: CVE-2020-28896
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Sat Nov 21 14:07:52 2020 (r555984)
+++ head/security/vuxml/vuln.xml Sat Nov 21 14:41:33 2020 (r555985)
@@ -58,6 +58,33 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="dc132c91-2b71-11eb-8cfd-4437e6ad11c4">
+ <topic>mutt -- authentication credentials being sent over an unencrypted connection</topic>
+ <affects>
+ <package>
+ <name>mutt</name>
+ <range><lt>2.0.2</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Kevin J. McCarthy reports:</p>
+ <blockquote cite="https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59a">
+ <p>Mutt had incorrect error handling when initially connecting to an IMAP
+ server, which could result in an attempt to authenticate without enabling TLS.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2020-28896</cvename>
+ <url>https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59a</url>
+ </references>
+ <dates>
+ <discovery>2020-11-20</discovery>
+ <entry>2020-11-20</entry>
+ </dates>
+ </vuln>
+
<vuln vid="040707f9-0b2a-11eb-8834-00155d01f202">
<topic>mozjpeg -- heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file</topic>
<affects>
More information about the svn-ports-head
mailing list