diff options
Diffstat (limited to 'NEWS')
| -rw-r--r-- | NEWS | 4 |
1 files changed, 3 insertions, 1 deletions
@@ -84,7 +84,7 @@ removed from a 6.5.0 or newer release.) -------------------------------------------------------------------------------- fetchmail-6.4.22 (not yet released): -# SECURITY FIX: +# SECURITY FIXES: * On IMAP connections, without --ssl and with nonempty --sslproto, meaning that fetchmail is to enforce TLS, and when the server or an attacker sends a PREAUTH greeting, fetchmail used to continue an unencrypted connection. @@ -98,6 +98,8 @@ fetchmail-6.4.22 (not yet released): Context" by Damian Poddebniak, Fabian Ising, Hanno Böck, and Sebastian Schinzel. The paper did not mention fetchmail. * On IMAP connections, --auth ssh no longer prevents STARTTLS negotiation. +* On IMAP connections, do not permit to override a server-side LOGINDISABLED + with --auth password any more. # BUG FIXES: * On IMAP connections, when AUTHENTICATE EXTERNAL fails and we have received the |