| Name | CVE-2019-8337 |
| Description | In msmtp 1.8.2 and mpop 1.4.3, when tls_trust_file has its default configuration, certificate-verification results are not properly checked. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 922345 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| mpop (PTS) | buster | 1.4.3-1 | fixed |
| bullseye | 1.4.12-1 | fixed |
| bookworm, sid, trixie | 1.4.18-1 | fixed |
| msmtp (PTS) | buster | 1.8.3-1 | fixed |
| bullseye | 1.8.11-2.1 | fixed |
| bookworm | 1.8.23-1 | fixed |
| sid, trixie | 1.8.24-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| mpop | source | jessie | (not affected) | | | |
| mpop | source | stretch | (not affected) | | | |
| mpop | source | (unstable) | 1.4.3-1 | | | |
| msmtp | source | jessie | (not affected) | | | |
| msmtp | source | stretch | (not affected) | | | |
| msmtp | source | (unstable) | 1.8.3-1 | | | 922345 |
Notes
[stretch] - mpop <not-affected> (Vulnerable code introduced later)
[jessie] - mpop <not-affected> (Vulnerable code introduced later)
[stretch] - msmtp <not-affected> (Vulnerable code introduced later)
[jessie] - msmtp <not-affected> (Vulnerable code introduced later)
mpop: Introduced by: https://git.marlam.de/gitweb/?p=mpop.git;a=commit;h=3162356734663a0ea0f88857c4ace21fac1b023b (1.4.2)
mpop: Fixed by: https://git.marlam.de/gitweb/?p=mpop.git;a=commit;h=95b96da443a24a4a9cb6664aefff9f6fcc7ac86e (1.4.3)
msmtp: Introduced by: https://git.marlam.de/gitweb/?p=msmtp.git;a=commit;h=37371fa07729bfc11761b6d11befd7271528090d (1.8.2)
msmtp: Fixed by: https://git.marlam.de/gitweb/?p=msmtp.git;a=commit;h=a81d0a5126304f9f8b29a75d058044dc67d07663 (1.8.3)