CVE-2020-14929

Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.

USN-7360-1 — alpine vulnerabilities

Affected: Ubuntu:Pro:16.04:LTS: alpine, Ubuntu:Pro:18.04:LTS: alpine, Ubuntu:Pro:20.04:LTS: alpine

It was discovered that Alpine did not use a secure connection under certain circumstances. A remote attacker could possibly use this issue to leak sensitive information. (CVE-2020-14929)

It was discovered that Alpine could allow untagged responses from an IMAP server before upgrading to a TLS connection. A remote attacker could possibly use this issue to leak sensitive information. (CVE-2021-38370)

It was discovered that Alpine could crash when receiving certain SMTP commands. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2021-46853)

Most recent entries from all

CVE-2020-14929

USN-7360-1 — alpine vulnerabilities