Summary
It was discovered that Alpine did not use a secure connection under
certain circumstances. A remote attacker could possibly use this issue to
leak sensitive information. (CVE-2020-14929)
It was discovered that Alpine could allow untagged responses from an
IMAP server before upgrading to a TLS connection. A remote attacker could
possibly use this issue to leak sensitive information. (CVE-2021-38370)
It was discovered that Alpine could crash when receiving certain SMTP
commands. A remote attacker could possibly use this issue to cause a denial
of service. (CVE-2021-46853)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | alpine | 2.20+dfsg1-2ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | alpine | 2.21+dfsg1-1ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | alpine | 2.22+dfsg1-1ubuntu0.1~esm1 |
Vulnerabilities 3
-
Medium 5.9
Alpine before 2.25 allows remote attackers to cause a denial of service (application crash) when LIST or LSUB is sent b…
-
Unscored —
Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involv…
-
Unscored —
In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.