Directory Traversal Vulnerability in Mutt Package - CVE-2018-14355
Summary
ALPINE-CVE-2018-14355: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name. Affects mutt versions < 1.10.1-r0. Fixed in 1.10.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Mutt is a well-known email client that supports various protocols, including IMAP and POP3. It is designed for users who prefer a text-based interface for managing their emails. Mutt is highly configurable and supports features like threading, multiple mailbox formats, and extensive customization options. However, prior to version 1.10.1, Mutt was found to be vulnerable to a directory traversal issue that could allow unauthorized access to mailbox names.
Vulnerability Detail
An issue was discovered in Mutt before version 1.10.1 and NeoMutt before July 16, 2018. The vulnerability lies in the imap/util.c file, where the handling of '..' directory traversal in mailbox names is flawed. This flaw could potentially allow an attacker to access files and directories outside the intended mailbox structure, leading to unauthorized data exposure. The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.10.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade muttTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using mailbox names that include '..' to prevent potential exploitation of this vulnerability until the package can be updated.
Conclusion
The directory traversal vulnerability in Mutt (CVE-2018-14355) poses a moderate risk to users of the email client. It is crucial to update to the patched version to mitigate potential security threats. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for mutt →
FAQ
CVE-2018-14355 is a vulnerability in the Mutt email client that allows directory traversal through improper handling of mailbox names.
You can check your Mutt version by running mutt -v in the terminal. If your version is below 1.10.1, it is affected.
The risks include unauthorized access to sensitive files and directories, potentially leading to data breaches.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software without needing access to the code.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without signing up.
References
Related vulnerabilities
Recent vulnerabilities recorded for mutt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
