CVE-2020-14954: mutt +5 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2020-14954

CVSS 5.9 · Medium EPSS 2,3%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada mutt, debian linux +4 lainnya. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."

Rincian

Terbit di NVD: 21 Juni 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
EPSS (30 hari): 2,3% peluang dieksploitasi; lebih tinggi dari 82,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
mutt	mutt	Semua versi sebelum 1.14.4
debian	debian linux	Versi 9.0
debian	debian linux	Versi 10.0
neomutt	neomutt	Semua versi sebelum 20200619
fedoraproject	fedora	Versi 31
fedoraproject	fedora	Versi 32
debian	debian linux	Versi 8.0
canonical	ubuntu linux	Versi 12.04
canonical	ubuntu linux	Versi 16.04
canonical	ubuntu linux	Versi 18.04
canonical	ubuntu linux	Versi 19.10
canonical	ubuntu linux	Versi 20.04
opensuse	leap	Versi 15.1
opensuse	leap	Versi 15.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20200615/000023.html mailing list · advisory vendor
https://github.com/neomutt/neomutt/commit/fb013ec666759cb8a9e294347c7b4c1f597639cc patch
https://gitlab.com/muttmua/mutt/-/commit/c547433cdf2e79191b15c6932c57f1472bfb5ff4 patch
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00064.html advisory pihak ketiga
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00070.html advisory pihak ketiga
https://gitlab.com/muttmua/mutt/-/issues/248 issue tracking · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2020/06/msg00039.html mailing list · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2020/06/msg00040.html mailing list · advisory pihak ketiga
https://security.gentoo.org/glsa/202007-57 advisory pihak ketiga
https://usn.ubuntu.com/4403-1/ advisory pihak ketiga
https://www.debian.org/security/2020/dsa-4707 advisory pihak ketiga
https://www.debian.org/security/2020/dsa-4708 advisory pihak ketiga
http://www.mutt.org/ product
https://github.com/neomutt/neomutt/releases/tag/20200619 release notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFMEILCBKMZRR...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3LXFVPTLK4PN...

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.