diff options
| author | Matthias Andree <matthias.andree@gmx.de> | 2021-08-26 23:53:14 +0200 |
|---|---|---|
| committer | Matthias Andree <matthias.andree@gmx.de> | 2021-08-26 23:53:14 +0200 |
| commit | b82c3ccb65e3279996a690ebf577263d7730e0b3 (patch) | |
| tree | de9b79d7ec877032c3bcfd1d62bb4561cd1e8702 /NEWS | |
| parent | 3aad706dc9dd9fe6bcedc7d5e09037edf88f9e43 (diff) | |
| download | fetchmail-b82c3ccb65e3279996a690ebf577263d7730e0b3.tar.gz fetchmail-b82c3ccb65e3279996a690ebf577263d7730e0b3.tar.bz2 fetchmail-b82c3ccb65e3279996a690ebf577263d7730e0b3.zip | |
SECURITY: IMAP: PREAUTH->abort if STARTTLS needed
On --sslproto auto (or other nonempty values), when
receiving IMAP PREAUTH state, abort the connection,
rather than continuing with cleartext.
--ssl is unaffected because it always negotiates TLS.
See fetchmail-SA-2021-02.txt for details.
Diffstat (limited to 'NEWS')
| -rw-r--r-- | NEWS | 17 |
1 files changed, 17 insertions, 0 deletions
@@ -82,6 +82,23 @@ removed from a 6.5.0 or newer release.) server to test against. Use GSSAPI. -------------------------------------------------------------------------------- +fetchmail-6.4.22 (not yet released): + +# SECURITY FIX: +* On IMAP connections, without --ssl and with nonempty --sslproto, meaning that + fetchmail is to enforce TLS, and when the server or an attacker sends + a PREAUTH greeting, fetchmail used to continue an unencrypted connection. + Now, log the error and abort the connection. + + Recommendation for servers that support SSL/TLS-wrapped or "implicit" mode on + a dedicated port (default 993): use --ssl. + + Reported by: Andrew C. Aitchison, based on the USENIX Security 21 paper "Why + TLS is better without STARTTLS - A Security Analysis of STARTTLS in the Email + Context" by Damian Poddebniak, Fabian Ising, Hanno Böck, and Sebastian + Schinzel. The paper did not mention fetchmail. + +-------------------------------------------------------------------------------- fetchmail-6.4.21 (released 2021-08-09, 30042 LoC): # REGRESSION FIX: |