Unscored CVE-2021-38373 EUVD-2021-24826GHSA-rc8g-gfxp-864v

In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authen…

Published Aug 10, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Package: kmailtransport Package: ksmtp Package: ksmtp Ecosystem: Debian Ecosystem: Ubuntu

Description

In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	ksmtp	21.12.3-2	—
Debian 13	ksmtp	21.12.3-2	—
Debian 12	ksmtp	21.12.3-2	—

Ubuntu