Critical Vulnerability in Mutt Package: Unsafe Character Handling in Message Cache Pathnames
Summary
ALPINE-CVE-2018-14362: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. Affects mutt versions < 1.10.1-r0. Fixed in 1.10.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mutt is a popular open-source email client known for its powerful features and flexibility. It allows users to manage their emails efficiently through a command-line interface. However, Mutt has been found to have a vulnerability that affects its handling of message-cache pathnames, which could lead to security risks if exploited.
Vulnerability Detail
An issue was discovered in Mutt before version 1.10.1, where the pop.c file does not properly restrict characters that may interact unsafely with message-cache pathnames. Specifically, the presence of a '/' character can lead to potential path traversal attacks, allowing unauthorized access to sensitive files or directories. This vulnerability has a CVSS score of 9.8, indicating a critical severity level, and it can result in significant data exposure and integrity issues.
How To Fix
Minimum fixed version
1.10.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade muttTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using Mutt until the package is updated. Additionally, ensure that any configurations do not allow unsafe characters in message-cache pathnames.
Conclusion
The vulnerability in Mutt poses a significant risk due to improper handling of message-cache pathnames. Users are strongly advised to update to the latest version to mitigate potential security threats. Regular monitoring and updates are essential to maintain the integrity of your software.
See every vulnerability recorded for mutt →
FAQ
The vulnerability allows unsafe characters in message-cache pathnames, which can lead to path traversal attacks.
You can check your Mutt version using the command 'mutt -v' in the terminal. If it is below 1.10.1, it is affected.
As a workaround, avoid using Mutt until it is updated or ensure that your configurations do not allow unsafe characters.
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for mutt.
