Description
common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | claws-mail | 3.17.6-1 | — |
| Debian 13 | claws-mail | 3.17.6-1 | — |
| Debian 12 | claws-mail | 3.17.6-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | claws-mail | No fix yet | — |
| Ubuntu 18.04 LTS | claws-mail | No fix yet | — |
| Ubuntu 16.04 LTS | claws-mail | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP3 | claws-mail | 3.18.0-bp153.2.3.1 | openSUSE-SU-2021:1045-1 |
| SUSE Package Hub 15 SP2 | claws-mail | 3.17.6-bp152.3.3.1 | openSUSE-SU-2021:1045-1, openSUSE-SU-2020:1822-1, openSUSE-SU-2020:1192-1 |
| SUSE Package Hub 15 SP1 | claws-mail | 3.17.3-bp151.3.3.1 | openSUSE-SU-2020:1822-1, openSUSE-SU-2020:1269-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | claws-mail | 4.0.0-2.5 | openSUSE-SU-2024:10686-1 |
| openSUSE Leap 15.3 | claws-mail | 3.18.0-bp153.2.3.1 | openSUSE-SU-2021:1045-1 |
| openSUSE Leap 15.2 | claws-mail | 3.17.6-lp152.3.3.1 | openSUSE-SU-2021:1045-1, openSUSE-SU-2020:1822-1, openSUSE-SU-2020:1139-1 |
| openSUSE Leap 15.1 | claws-mail | 3.17.3-lp151.2.3.1 | openSUSE-SU-2020:1822-1, openSUSE-SU-2020:1116-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | claws-mail | 3.17.6-r0 | — |
| Alpine v3.23 | claws-mail | 3.17.6-r0 | — |
| Alpine v3.22 | claws-mail | 3.17.6-r0 | — |
| Alpine v3.21 | claws-mail | 3.17.6-r0 | — |
| Alpine v3.20 | claws-mail | 3.17.6-r0 | — |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | claws-mail | 3.17.6-r0 | — |
| Alpine v3.18 | claws-mail | 3.17.6-r0 | — |
| Alpine v3.17 | claws-mail | 3.17.6-r0 | — |
| Alpine v3.16 | claws-mail | 3.17.6-r0 | — |
| Alpine v3.15 | claws-mail | 3.17.6-r0 | — |
| Alpine v3.14 | claws-mail | 3.17.6-r0 | — |
| Alpine v3.13 | claws-mail | 3.17.6-r0 | — |
| Alpine v3.12 | claws-mail | 3.17.6-r0 | — |
Advisories 7
- openSUSE-SU-2020:1139-1 Security update for claws-mail SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1269-1 Security update for claws-mail SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10686-1 claws-mail-4.0.0-2.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1822-1 Security update for claws-mail SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:1045-1 Security update for claws-mail SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1192-1 Security update for claws-mail SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1116-1 Security update for claws-mail SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://git.claws-mail.org/?p=claws.git%3Ba=commit%3Bh=fcc25329049b6f9bd8d890f1197ed61eb12e14d5
- https://git.claws-mail.org/?p=claws.git%3Ba=blob%3Bf=RELEASE_NOTES
- GLSA-202007-56 vendor-advisory
- openSUSE-SU-2020:1116 vendor-advisory
- FEDORA-2020-2def860ce7 vendor-advisory
- FEDORA-2020-fe6c1a9c16 vendor-advisory
- openSUSE-SU-2020:1139 vendor-advisory
- openSUSE-SU-2020:1269 vendor-advisory
- openSUSE-SU-2020:1192 vendor-advisory
- openSUSE-SU-2020:1822 vendor-advisory