<p>There is no fixed version for <code>RHEL:8</code> <code>mutt</code>.</p>

Arbitrary Command Injection Affecting mutt package, versions *

Threat Intelligence

0.26% (67^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-RHEL8-MUTT-1342342
published 26 Jul 2021
disclosed 16 Jun 2020

Report a new vulnerability Found a mistake?

Introduced: 16 Jun 2020

CVE-2020-14954 Open this link in a new tab CWE-77 Open this link in a new tab

How to fix?

There is no fixed version for RHEL:8 mutt.

NVD Description

Note: Versions mentioned in the description apply only to the upstream mutt package and not the mutt package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

High
Privileges Required (PR)

None
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

None
Integrity (I)

High
Availability (A)

None

Arbitrary Command Injection Affecting mutt package, versions *

Severity

Based on Red Hat Enterprise Linux security rating