Revision 25fffa3...

Go back to digest for 23rd March 2014

Bug Fixes in KDE-PIM

Jan Kundrát committed changes in [trojita/v0.4.1] /Imap:

IMAP: refuse to work when STARTTLS is required but server sends PREAUTH

Oops, we cannot send STARTTLS when the connection is already authenticated.
This is serious enough to warrant an error; an attacker might be going after a
plaintext of a message we're going to APPEND, etc.

Thanks to Arnt Gulbrandsen on the imap-protocol ML for asking what happens when
we're configured to request STARTTLS and a PREAUTH is received, and to Michael M
Slusarz for starting that discussion.

Hope the error message is readable enough.

CVE: CVE-2014-2567

File Changes

Modified 3 files
  • /Imap
  •   tests/test_Imap_Tasks_OpenConnection.cpp
  •   tests/test_Imap_Tasks_OpenConnection.h
  •   src/Tasks/OpenConnectionTask.cpp
3 files changed in total