Ensure IMAP connection is closed after a connection error.
During connection, if the server provided an illegal initial response, Mutt "bailed", but did not actually close the connection. The calling code unfortunately relied on the connection status to decide to continue with authentication, instead of checking the "bail" return value. This could result in authentication credentials being sent over an unencrypted connection, without $ssl_force_tls being consulted. Fix this by strictly closing the connection on any invalid response during connection. The fix is intentionally small, to ease backporting. A better fix would include removing the 'err_close_conn' label, and perhaps adding return value checking in the caller (though this change obviates the need for that). This addresses CVE-2020-28896. Thanks to Gabriel Salles-Loustau for reporting the problem, and providing test cases to reproduce.
parent
d4c97068
-
mentioned in commit 8c967ad5
-
🤓 @stigtspmentioned in commit grovely/vendor/github.com/nixos/nixpkgs@23db21e3
-
🤓 @stigtspmentioned in commit lama-corp/infra/mirrors/nixpkgs@4586b2f0d0cce2916766dfcd1b717c0940d865ef
Please register or sign in to comment