CVE-2020-14154 : Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an e

Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.

Published 2020-06-15 17:15:11

Updated 2023-03-01 16:01:38

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2020-14154

Mutt » Mutt
Versions before (<) 1.14.3
cpe:2.3:a:mutt:mutt:*:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 18.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 19.10
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 20.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-14154

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 56 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-14154

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:N	8.6	4.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
4.8	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	2.2	2.5	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None

References for CVE-2020-14154

http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20200608/000022.html

mutt 1.14.3 released
Mailing List;Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00064.html

[security-announce] openSUSE-SU-2020:0903-1: important: Security update
Broken Link

CVEs referencing this url
https://bugs.gentoo.org/728300

728300 – (CVE-2020-14093, CVE-2020-14154) [Tracker] Mutt mishandling of TLS (CVE-2020-{14093,14154})
Third Party Advisory

CVEs referencing this url
http://www.mutt.org

The Mutt E-Mail Client
Product;Vendor Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00070.html

[security-announce] openSUSE-SU-2020:0915-1: important: Security update
Broken Link

CVEs referencing this url
https://usn.ubuntu.com/4401-1/

USN-4401-1: Mutt vulnerabilities | Ubuntu security notices | Ubuntu
Third Party Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/202007-57

Mutt, Neomutt: Multiple vulnerabilities (GLSA 202007-57) — Gentoo security
Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-14154

Products affected by CVE-2020-14154

Exploit prediction scoring system (EPSS) score for CVE-2020-14154

CVSS scores for CVE-2020-14154

References for CVE-2020-14154