Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.2165
USN-4401-1: Mutt vulnerabilities
23 June 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Mutt
Publisher: Ubuntu
Operating System: Ubuntu
Impact/Access: Provide Misleading Information -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2020-14154 CVE-2020-14093
Reference: ESB-2020.2151
ESB-2020.2142
Original Bulletin:
https://usn.ubuntu.com/4401-1/
- --------------------------BEGIN INCLUDED TEXT--------------------
USN-4401-1: Mutt vulnerabilities
22 June 2020
mutt vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
o Ubuntu 20.04 LTS
o Ubuntu 19.10
o Ubuntu 18.04 LTS
o Ubuntu 16.04 LTS
o Ubuntu 12.04 ESM
Summary
Several security issues were fixed in Mutt.
Software Description
o mutt - text-based mailreader supporting MIME, GPG, PGP and threading
Details
It was discovered that Mutt incorrectly handled certain requests. An attacker
could possibly use this issue to enable MITM attacks. (CVE-2020-14093)
It was discovered that Mutt incorrectly handled certain requests. An attacker
could possibly use this issue to proceeds with a connection even if the user
rejects an expired intermediate certificate. (CVE-2020-14154)
Update instructions
The problem can be corrected by updating your system to the following package
versions:
Ubuntu 20.04 LTS
mutt - 1.13.2-1ubuntu0.1
Ubuntu 19.10
mutt - 1.10.1-2.1ubuntu0.1
Ubuntu 18.04 LTS
mutt - 1.9.4-3ubuntu0.2
Ubuntu 16.04 LTS
mutt - 1.5.24-1ubuntu0.3
Ubuntu 12.04 ESM
mutt - 1.5.21-5ubuntu2.4
To update your system, please follow these instructions: https://
wiki.ubuntu.com/Security/Upgrades .
After a standard system update you need to restart mutt to make all the
necessary changes.
References
o CVE-2020-14093
o CVE-2020-14154
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXvFIWeNLKJtyKPYoAQiRRQ//S1X67OX6u+QGtWZfiTikdzr1B6agMOJJ
bNgGbS/2SkRwUWY74KEIkDJS5+eQ538A+X96ywISdVLKfTEjzcFNEi5fLNu7fMHD
2l+mJkkCsoMtKqnnXK4Dv4nXaFzEzHI1PXQqqI/Ymo1fPBaLJ3cSLoWnJT9C5KYD
wfpPzJJDJFMdpeWZuvg281U1BfhtAiwUO/oCpReq3xgTKqfVxvfZ5+7MUxpOsnUq
7OfntgDWO36s2nxG3aiCRWsRZpH7xf0xO2/3n8Ks0ZcyZq3G4mcAJ7wqMdE59SDF
CtF5ijTnhVhb8cwbMlQjkvYtciMFdVDznFPpZSwjWmNS/bhS5cvjcagUXydbc9Yc
t6y5NmqSl7EMKxFMbeOHDLfsrGS1ywEmE/yq4gfN4HPcLkmyPWcxpYD2x6xrcdq7
P0O4SMLypT6AFAqQvmUQOw1NW/Viz4kcMXGW/mTpL8Fh25x48kb+luzWmi55BBXR
t1ZE8GUm4RmrLBnsD5A/E4qLPMw8drytStDl0ad2k2zkxXXqQrf5XTxNWQlptobv
i87Lhi4F7/QPJieu3D0xcMClBAYtNYlAoT3oa71xCKoCrXi2lFT2GMUmG0+nXfVo
w8nrQhAjak9q0onXcW1qCZJFWaA53sYQq0RIBGsg9iVaBlSqoDMPZS7kjl7hGOTa
mjZ046ge1w8=
=u7EG
-----END PGP SIGNATURE-----