summaryrefslogtreecommitdiff
path: root/pith
diff options
context:
space:
mode:
authorEduardo Chappa <chappa@washington.edu>2020-06-18 03:25:29 -0600
committerEduardo Chappa <chappa@washington.edu>2020-06-18 03:25:29 -0600
commit000edd9036b6aea5e6a06900ecd6c58faec665ab (patch)
treecb0e40cf17e1c6e3b1f69cb02fe1ef364e605d1a /pith
parent5cba97d032b16b89a6f73d5841e55bf13672f921 (diff)
downloadalpine-000edd9036b6aea5e6a06900ecd6c58faec665ab.tar.xz
* Security Bug: Alpine can be configured to start a secure connection using /tls
on an insecure connection. However, if the connection is PREAUTH, Alpine will not upgrade the connection to a secure connection, because a client must not issue a STARTTLS to a server that supports it in authenticated state. This makes Alpine continue to use an insecure connection with the server, exposing user data. Reported by Damian Poddebniak and Fabian Ising, from Münster University of Applied Sciences.
Diffstat (limited to 'pith')
-rw-r--r--pith/pine.hlp10
1 files changed, 9 insertions, 1 deletions
diff --git a/pith/pine.hlp b/pith/pine.hlp
index 850a84b5..eb20666f 100644
--- a/pith/pine.hlp
+++ b/pith/pine.hlp
@@ -140,7 +140,7 @@ with help text for the config screen and the composer that didn't have any
reasonable place to be called from.
Dummy change to get revision in pine.hlp
============= h_revision =================
-Alpine Commit 450 2020-06-17 12:40:13
+Alpine Commit 451 2020-06-18 03:25:21
============= h_news =================
<HTML>
<HEAD>
@@ -243,6 +243,14 @@ problems you find with this release.
Bugs addressed:
<UL>
+ <LI> Security Bug: Alpine can be configured to start a secure connection using /tls
+ on an insecure connection. However, if the connection is PREAUTH, Alpine
+ will not upgrade the connection to a secure connection, because a client
+ must not issue a STARTTLS to a server that supports it in authenticated
+ state. This makes Alpine continue to use an insecure connection with the
+ server, exposing user data. Reported by Damian Poddebniak and Fabian
+ Ising from Münster University of Applied Sciences.
+
<LI> Selecting by subject might not copy the subject of the current message
to the selection text correctly. Reported by Iosif Fettich.