diff options
| author | Matthias Andree <matthias.andree@gmx.de> | 2021-08-26 23:53:14 +0200 |
|---|---|---|
| committer | Matthias Andree <matthias.andree@gmx.de> | 2021-08-26 23:53:14 +0200 |
| commit | 8517491d8558e202a33294ac61f2268ef802f03f (patch) | |
| tree | 072c9250a1b678fe1173ea67b68e7346863c8b93 /NEWS | |
| parent | b11d834a4739595c52d982ff5bc2e87ed59b8a61 (diff) | |
| download | fetchmail-8517491d8558e202a33294ac61f2268ef802f03f.tar.gz fetchmail-8517491d8558e202a33294ac61f2268ef802f03f.tar.bz2 fetchmail-8517491d8558e202a33294ac61f2268ef802f03f.zip | |
SECURITY: POP3: changes for --auth ssh and RPA
These no longer defeat STARTTLS negotiation,
and RPA is only attempted with --auth any.
Diffstat (limited to 'NEWS')
| -rw-r--r-- | NEWS | 6 |
1 files changed, 5 insertions, 1 deletions
@@ -101,9 +101,13 @@ fetchmail-6.4.22 (not yet released): TLS is better without STARTTLS - A Security Analysis of STARTTLS in the Email Context" by Damian Poddebniak, Fabian Ising, Hanno Böck, and Sebastian Schinzel. The paper did not mention fetchmail. -* On IMAP connections, --auth ssh no longer prevents STARTTLS negotiation. +* On IMAP and POP3 connections, --auth ssh no longer prevents STARTTLS + negotiation. * On IMAP connections, do not permit to override a server-side LOGINDISABLED with --auth password any more. +* On POP3 connections, the possibility for RPA authentication (by probing with + an AUTH command without arguments) no longer prevents STARTTLS negotiation. +* For POP3 connections, RPA is only attempted if the authentication type is any. # BUG FIXES: * On IMAP connections, when AUTHENTICATE EXTERNAL fails and we have received the |