CVE-2024-49393

Published: Nov 12, 2024Modified: Jun 26, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD (Secondary)

Description

In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.

Affected (4)

Products: Mutt: Mutt · Neomutt: Neomutt · Redhat: Enterprise Linux

1 product

1 product

1 product

Enterprise Linux

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Mutt Mutt	All versions
Neomutt Neomutt	All versions

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0

Related CWEs

Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References (5)

https://access.redhat.com/security/cve/CVE-2024-49393

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2325317

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://github.com/neomutt/neomutt/issues/4223

Source: secalert@redhat.com

https://github.com/neomutt/neomutt/pull/4221

Source: secalert@redhat.com

https://github.com/neomutt/neomutt/pull/4227

Source: secalert@redhat.com

Timeline

No history available yet.