49 lines
1.6 KiB
Diff
49 lines
1.6 KiB
Diff
|
From 04b06aaa3e0cc0022b9b01dbca2863756ebbf59a Mon Sep 17 00:00:00 2001
|
||
|
|
From: Kevin McCarthy <kevin@8t8.us>
|
||
|
|
Date: Mon, 16 Nov 2020 10:20:21 -0800
|
||
|
|
Subject: [PATCH] Ensure IMAP connection is closed after a connection error.
|
||
|
|
|
||
|
|
During connection, if the server provided an illegal initial response,
|
||
|
|
Mutt "bailed", but did not actually close the connection. The calling
|
||
|
|
code unfortunately relied on the connection status to decide to
|
||
|
|
continue with authentication, instead of checking the "bail" return
|
||
|
|
value.
|
||
|
|
|
||
|
|
This could result in authentication credentials being sent over an
|
||
|
|
unencrypted connection, without $ssl_force_tls being consulted.
|
||
|
|
|
||
|
|
Fix this by strictly closing the connection on any invalid response
|
||
|
|
during connection. The fix is intentionally small, to ease
|
||
|
|
backporting. A better fix would include removing the 'err_close_conn'
|
||
|
|
label, and perhaps adding return value checking in the caller (though
|
||
|
|
this change obviates the need for that).
|
||
|
|
|
||
|
|
This addresses CVE-2020-28896. Thanks to Gabriel Salles-Loustau for
|
||
|
|
reporting the problem, and providing test cases to reproduce.
|
||
|
|
|
||
|
|
[Retrieved from:
|
||
|
|
https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59a]
|
||
|
|
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
|
||
|
|
---
|
||
|
|
imap/imap.c | 2 +-
|
||
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/imap/imap.c b/imap/imap.c
|
||
|
|
index b24e8a3f..b13dd54d 100644
|
||
|
|
--- a/imap/imap.c
|
||
|
|
+++ b/imap/imap.c
|
||
|
|
@@ -561,9 +561,9 @@ int imap_open_connection (IMAP_DATA* idata)
|
||
|
|
|
||
|
|
#if defined(USE_SSL)
|
||
|
|
err_close_conn:
|
||
|
|
- imap_close_connection (idata);
|
||
|
|
#endif
|
||
|
|
bail:
|
||
|
|
+ imap_close_connection (idata);
|
||
|
|
FREE (&idata->capstr);
|
||
|
|
return -1;
|
||
|
|
}
|
||
|
|
--
|
||
|
|
GitLab
|
||
|
|
|