N/A

Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.

N/A

N/A

Mutt和NeoMutt 安全漏洞

Mutt是Michael Elkins个人开发者的一款用于类Unix系统下且基于文本的邮件客户端。NeoMutt是一款命令行邮件阅读器。 Mutt 2.0.2 之前版本和 NeoMutt 2020-11-20之前版本存在安全漏洞，该漏洞源于不能确保处理$ssl force tls，连接未正确关闭，代码可能继续尝试进行身份验证。这可能导致身份验证凭据暴露在未加密的连接上，或暴露在中间的机器上。

N/A

N/A