CVE-2014-2576 plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-i...
MediumCVSS 6.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/claws-mail(Debian:12) | < 3.10.1-1 | 3.10.1-1 |
| debian/claws-mail(Debian:13) | < 3.10.1-1 | 3.10.1-1 |
| debian/claws-mail(Debian:14) | < 3.10.1-1 | 3.10.1-1 |
| claws-mail | <= 3.9.3 | No fix listed |
| opensuse | = 12.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
References
- Debian Security Tracker CVE-2014-2576 vendor-advisory
- openSUSE-SU-2014:1291 vendor-advisory
- [oss-security] 20140322 Re: CVE request: claws-mail vcalendar plugin stores user/password in cleartext mailing-list
- 60422 third-party-advisory
- [claws-mail] 20140526 Claws Mail 3.10.0 Unleashed!!! mailing-list
- www.thewildbeast.co.uk vendor-advisory
- bugs.debian.org issue-tracking