0001-Ensure-IMAP-connection-is-closed-after-a-connection-error.patch 1.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748
  1. From 04b06aaa3e0cc0022b9b01dbca2863756ebbf59a Mon Sep 17 00:00:00 2001
  2. From: Kevin McCarthy <kevin@8t8.us>
  3. Date: Mon, 16 Nov 2020 10:20:21 -0800
  4. Subject: [PATCH] Ensure IMAP connection is closed after a connection error.
  5. During connection, if the server provided an illegal initial response,
  6. Mutt "bailed", but did not actually close the connection. The calling
  7. code unfortunately relied on the connection status to decide to
  8. continue with authentication, instead of checking the "bail" return
  9. value.
  10. This could result in authentication credentials being sent over an
  11. unencrypted connection, without $ssl_force_tls being consulted.
  12. Fix this by strictly closing the connection on any invalid response
  13. during connection. The fix is intentionally small, to ease
  14. backporting. A better fix would include removing the 'err_close_conn'
  15. label, and perhaps adding return value checking in the caller (though
  16. this change obviates the need for that).
  17. This addresses CVE-2020-28896. Thanks to Gabriel Salles-Loustau for
  18. reporting the problem, and providing test cases to reproduce.
  19. [Retrieved from:
  20. https://gitlab.com/muttmua/mutt/-/commit/04b06aaa3e0cc0022b9b01dbca2863756ebbf59a]
  21. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
  22. ---
  23. imap/imap.c | 2 +-
  24. 1 file changed, 1 insertion(+), 1 deletion(-)
  25. diff --git a/imap/imap.c b/imap/imap.c
  26. index b24e8a3f..b13dd54d 100644
  27. --- a/imap/imap.c
  28. +++ b/imap/imap.c
  29. @@ -561,9 +561,9 @@ int imap_open_connection (IMAP_DATA* idata)
  30. #if defined(USE_SSL)
  31. err_close_conn:
  32. - imap_close_connection (idata);
  33. #endif
  34. bail:
  35. + imap_close_connection (idata);
  36. FREE (&idata->capstr);
  37. return -1;
  38. }
  39. --
  40. GitLab