[Bug 1125420] New: VUL-0: CVE-2019-8337: msmtp: certificate-verification results are not properly checked in tls_trust_file default configuration
http://bugzilla.suse.com/show_bug.cgi?id=1125420 Bug ID: 1125420 Summary: VUL-0: CVE-2019-8337: msmtp: certificate-verification results are not properly checked in tls_trust_file default configuration Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mrueckert@suse.com Reporter: rfrohl@suse.com QA Contact: security-team@suse.de Found By: --- Blocker: --- CVE-2019-8337 In msmtp 1.8.2, when tls_trust_file has its default configuration, certificate-verification results are not properly checked. References: https://nvd.nist.gov/vuln/detail/CVE-2019-8337 https://marlam.de/msmtp/news/ -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.suse.com/show_bug.cgi?id=1125420 http://bugzilla.suse.com/show_bug.cgi?id=1125420#c1 --- Comment #1 from Robert Frohl <rfrohl@suse.com> --- Only Tumbleweed is affected I believe. An active submission with an update already exists and is awaiting approval. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.suse.com/show_bug.cgi?id=1125420 Robert Frohl <rfrohl@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Security |Security Version|Leap 42.3 |Current Product|openSUSE Distribution |openSUSE Tumbleweed -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.suse.com/show_bug.cgi?id=1125420 Swamp Workflow Management <swamp@suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.suse.com/show_bug.cgi?id=1125420 http://bugzilla.suse.com/show_bug.cgi?id=1125420#c2 --- Comment #2 from Swamp Workflow Management <swamp@suse.de> --- This is an autogenerated message for OBS integration: This bug (1125420) was mentioned in https://build.opensuse.org/request/show/679267 Factory / msmtp -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com