Security Update for getmail4
Summary
DSA-3091-1: getmail4 - security update. Affects getmail4 versions < 4.46.0-1~deb7u1. Fixed in 4.46.0-1~deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
getmail4 is a mail retriever with support for POP3, IMAP4, and SDPS. It allows users to fetch and download emails from remote mail servers. This vulnerability affects getmail4 versions 4.0.0 through 4.44.0 and could potentially lead to man-in-the-middle attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2014-7273, CVE-2014-7274, and CVE-2014-7275, is related to the implementation of IMAP-over-SSL and POP3-over-SSL in getmail4. In versions 4.0.0 through 4.43.0, the IMAP-over-SSL implementation does not verify X.509 certificates from SSL servers, allowing attackers to spoof IMAP servers and obtain sensitive information using crafted certificates. In version 4.44.0, the IMAP-over-SSL implementation fails to verify that the server hostname matches the domain name in the X.509 certificate's Common Name (CN) field, enabling man-in-the-middle attacks. Similarly, the POP3-over-SSL implementation in versions 4.0.0 through 4.44.0 also lacks X.509 certificate verification, making it susceptible to spoofing attacks.
How To Fix
Minimum fixed version
4.46.0-1~deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade getmail4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
It is crucial to upgrade getmail4 to the recommended versions to mitigate the risk of man-in-the-middle attacks and protect sensitive information. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for getmail4 →
FAQ
getmail4 is a mail retriever that allows users to fetch and download emails from remote mail servers. It supports POP3, IMAP4, and SDPS protocols.
This vulnerability could lead to man-in-the-middle attacks, allowing attackers to spoof IMAP or POP3 servers and obtain sensitive information.
Versions 4.0.0 through 4.44.0 of getmail4 are affected by this vulnerability.
To fix this vulnerability, you should upgrade getmail4 to the recommended versions: 4.46.0-1~deb7u1 for wheezy, 4.46.0-1 for jessie, and 4.46.0-1 for sid.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for getmail4.
