Critical Vulnerability in Mutt Package: Zero-Length UID Handling Issue
Summary
ALPINE-CVE-2018-14356: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c mishandles a zero-length UID. Affects mutt versions < 1.10.1-r0. Fixed in 1.10.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mutt is a popular text-based email client known for its flexibility and powerful features. It supports various protocols and offers extensive configuration options, making it a preferred choice for users who prefer command-line interfaces. However, prior to version 1.10.1, Mutt contained a vulnerability that could lead to severe security issues due to improper handling of zero-length UIDs.
Vulnerability Detail
The vulnerability, identified as CVE-2018-14356, arises from a flaw in the pop.c file of Mutt versions before 1.10.1. This issue occurs when the application mishandles a zero-length UID, potentially allowing an attacker to exploit this weakness. The ramifications include unauthorized access to sensitive information, data corruption, or even denial of service, as the application may behave unpredictably when encountering such UIDs.
How To Fix
Minimum fixed version
1.10.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade muttTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using zero-length UIDs in their email configurations. However, this is not a comprehensive solution and updating the package is strongly recommended.
Conclusion
The vulnerability CVE-2018-14356 in the Mutt package poses significant security risks due to improper handling of zero-length UIDs. Users are strongly advised to update to version 1.10.1-r0 or later to mitigate these risks. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for mutt →
FAQ
CVE-2018-14356 is a vulnerability in Mutt that involves improper handling of zero-length UIDs, which can lead to security risks.
You can check your Mutt version by running mutt -v in your terminal. If it is below 1.10.1, it is affected.
The vulnerability can lead to unauthorized access, data corruption, or denial of service, compromising the security of your email communications.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for mutt.
