CVE-2014-7274

Published: Oct 8, 2014Modified: May 6, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

The IMAP-over-SSL implementation in getmail 4.44.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IMAP servers and obtain sensitive information via a crafted certificate from a recognized Certification Authority.

Affected (1)

Products: Getmail: Getmail

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Getmail Getmail	Version 4.44.0

Related CWEs

References (10)

http://lists.opensuse.org/opensuse-updates/2014-10/msg00029.html

Source: cve@mitre.org

http://openwall.com/lists/oss-security/2014/10/07/33

Source: cve@mitre.org

http://pyropus.ca/software/getmail/CHANGELOG

Source: cve@mitre.org

http://secunia.com/advisories/61229

Source: cve@mitre.org

http://www.debian.org/security/2014/dsa-3091

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2014-10/msg00029.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2014/10/07/33

Source: af854a3a-2127-422b-91ae-364da2661108

http://pyropus.ca/software/getmail/CHANGELOG

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/61229

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2014/dsa-3091

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.