Critical Command Execution Vulnerability in Mutt Package
Summary
ALPINE-CVE-2018-14357: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. Affects mutt versions < 1.10.1-r0. Fixed in 1.10.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mutt is a popular text-based email client known for its flexibility and powerful features. It allows users to manage their emails efficiently through a command-line interface. However, prior to version 1.10.1, Mutt was found to be vulnerable to a command execution flaw that could be exploited by remote IMAP servers, posing a significant security risk to users.
Vulnerability Detail
An issue was discovered in Mutt before version 1.10.1 and NeoMutt before July 16, 2018. The vulnerability allows remote IMAP servers to execute arbitrary commands via backquote characters, particularly related to the mailboxes command associated with automatic subscription. This could lead to unauthorized access and manipulation of user data, making it a critical security concern.
How To Fix
Minimum fixed version
1.10.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade muttTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable automatic subscription to mailboxes or avoid using IMAP servers that are untrusted until the package is updated. This can help mitigate the risk of exploitation while waiting for the official patch.
Conclusion
The command execution vulnerability in Mutt poses a serious risk to users, allowing remote IMAP servers to execute arbitrary commands. It is essential to update to version 1.10.1-r0 or later to mitigate this risk. Users should also consider using Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for mutt →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, consider disabling automatic subscriptions to mailboxes or using trusted IMAP servers to reduce the risk of exploitation.
Yes, the vulnerability affects all versions of Mutt prior to 1.10.1, so it is crucial to update to the latest version.
Exploitation of this vulnerability could lead to unauthorized command execution, allowing attackers to manipulate user data and potentially gain access to sensitive information.
References
Related vulnerabilities
Recent vulnerabilities recorded for mutt.
