Revision 25fffa3...
Go back to digest for 23rd March 2014Bug Fixes in KDE-PIM
Jan Kundrát committed changes in [trojita/v0.4.1] /Imap:
IMAP: refuse to work when STARTTLS is required but server sends PREAUTH
Oops, we cannot send STARTTLS when the connection is already authenticated.
This is serious enough to warrant an error; an attacker might be going after a
plaintext of a message we're going to APPEND, etc.
Thanks to Arnt Gulbrandsen on the imap-protocol ML for asking what happens when
we're configured to request STARTTLS and a PREAUTH is received, and to Michael M
Slusarz for starting that discussion.
Hope the error message is readable enough.
CVE: CVE-2014-2567
File Changes
Modified 3 files
- /Imap
- tests/test_Imap_Tasks_OpenConnection.cpp
- tests/test_Imap_Tasks_OpenConnection.h
- src/Tasks/OpenConnectionTask.cpp
3 files changed in total