Description
Mutt 1.5.19, when linked against (1) OpenSSL (mutt_ssl.c) or (2) GnuTLS (mutt_ssl_gnutls.c), allows connections when only one TLS certificate in the chain is accepted instead of verifying the entire chain, which allows remote attackers to spoof trusted servers via a man-in-the-middle attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mutt | 1.5.20-1 | — |
| Debian 13 | mutt | 1.5.20-1 | — |
| Debian 12 | mutt | 1.5.20-1 | — |
References
- 35288 vdb-entry
- FEDORA-2009-6465 vendor-advisory
- http://dev.mutt.org/hg/mutt/rev/64bf199c8d8a
- mutt-x509-security-bypass(51068) vdb-entry
- http://dev.mutt.org/hg/mutt/rev/8f11dd00c770
- [oss-security] 20090610 Mutt 1.5.19 SSL chain verification flaw mailing-list