bugMail Notification, A mail notification for freedesktop.org-compliant system trays - Bugs: bug #20131, Sends passwords in cleartext when...


You are not allowed to post comments on this tracker with your current authentication level.

bug #20131: Sends passwords in cleartext when SSL is unavailable

Submitted by:  None
Submitted on:  Sat 09 Jun 2007 01:09:48 PM UTC  
Severity: 6 - SecurityStatus: Fixed
Privacy: PublicAssigned to: None
Originator Name: Originator Email: -unavailable-
Open/Closed: Closed

(Jump to the original submission Jump to the original submission)

Tue 26 Jun 2007 12:38:21 PM UTC, comment #7:

Fixed in 4.1

Jean-Yves Lefort <jylefort>
Project Administrator
Sun 17 Jun 2007 07:08:45 AM UTC, comment #6:

Yes, I am. I submitted the bug report in Debian and here. I also notified the Debian security team after things were quiet for a couple of days, who I presume passed on the information to the wider community leading the the assignment of the CVE entry.

Ted Percival <tedp>
Sun 17 Jun 2007 06:06:13 AM UTC, comment #5:

Ted are you the original submitter?

Jean-Yves Lefort <jylefort>
Project Administrator
Sun 17 Jun 2007 04:03:35 AM UTC, comment #4:

My testing indicates this problem is also in version 3.0, but not in 1.1 and 2.0.

Ted Percival <tedp>
Sat 16 Jun 2007 05:02:45 PM UTC, comment #3:

This is being tracked as CVE-2007-3209:

Ted Percival <tedp>
Sat 09 Jun 2007 04:00:26 PM UTC, comment #2:

Good catch, thanks. After changing the cpp symbols to 0/1, I updated the "#ifdef foo" occurrences but forgot to search for "#ifndef foo". :(

Jean-Yves Lefort <jylefort>
Project Administrator
Sat 09 Jun 2007 02:51:52 PM UTC, comment #1:

This is probably partly because some code uses "#ifndef WITH_SSL" when config.h has "#define WITH_SSL 0".

Sat 09 Jun 2007 01:09:48 PM UTC, original submission:

I noticed that the Debian package, which is compiled without SSL, silently falls back to unencrypted connections when the user has configured an account to use SSL/TLS. Mail Notification should not silently use an unencrypted connection, and it should be clear in the user interface when SSL/TLS is unavailable.

Originally reported at http://bugs.debian.org/428157 but I then realised upstream is a better place.



Attached Files
file #12991:  mail-notif-ssl.patch added by None (4KiB - text/x-patch - This should do the trick)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by tedp (Posted a comment)
  • -unavailable- added by jylefort (Posted a comment)

    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 26 Jun 2007 12:38:21 PM UTCjylefortStatusConfirmed=>Fixed
    Sat 09 Jun 2007 04:10:32 PM UTCtedpCarbon-Copy-=>Added tedp
    Sat 09 Jun 2007 04:00:26 PM UTCjylefortStatusNone=>Confirmed
    Sat 09 Jun 2007 03:07:58 PM UTCNoneAttached File-=>Added mail-notif-ssl.patch, #12991

    Back to the top

    Powered by Savane 3.1-cleanup1