CVE-2014-7273

NameCVE-2014-7273
DescriptionThe IMAP-over-SSL implementation in getmail 4.0.0 through 4.43.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof IMAP servers and obtain sensitive information via a crafted certificate.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-106-1, DSA-3091-1
NVD severitymedium (attack range: remote)
Debian Bugs766670

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
getmail4 (PTS)wheezy, wheezy (security)4.46.0-1~deb7u1fixed
jessie4.46.0-1+deb8u1fixed
stretch4.53.0-1fixed
buster, sid4.53.0-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
getmail4source(unstable)4.44.0-1medium766670
getmail4sourcesqueeze4.46.0-1~deb6u1mediumDLA-106-1
getmail4sourcewheezy4.46.0-1~deb7u1mediumDSA-3091-1

Search for package or bug name: Reporting problems