Mail Notification, A mail notification for freedesktop.org-compliant system trays - Bugs: bug #20131, Sends passwords in cleartext when...

Group

You are not allowed to post comments on this tracker with your current authentication level.

bug #20131: Sends passwords in cleartext when SSL is unavailable

Submitter:	None
Submitted:	Sat 09 Jun 2007 01:09:48 PM UTC


Severity:	6 - Security	Status:	Fixed
Privacy:	Public	Assigned to:	None
Originator Name:		Originator Email:	-email is unavailable-
Open/Closed:	Closed

Jump to the original submission

Tue 26 Jun 2007 12:38:21 PM UTC, comment #7: Fixed in 4.1	Jean-Yves Lefort <jylefort>
Sun 17 Jun 2007 07:08:45 AM UTC, comment #6: Yes, I am. I submitted the bug report in Debian and here. I also notified the Debian security team after things were quiet for a couple of days, who I presume passed on the information to the wider community leading the the assignment of the CVE entry.	Ted Percival <tedp>
Sun 17 Jun 2007 06:06:13 AM UTC, comment #5: Ted are you the original submitter?	Jean-Yves Lefort <jylefort>
Sun 17 Jun 2007 04:03:35 AM UTC, comment #4: My testing indicates this problem is also in version 3.0, but not in 1.1 and 2.0.	Ted Percival <tedp>
Sat 16 Jun 2007 05:02:45 PM UTC, comment #3: This is being tracked as CVE-2007-3209: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3209	Ted Percival <tedp>
Sat 09 Jun 2007 04:00:26 PM UTC, comment #2: Good catch, thanks. After changing the cpp symbols to 0/1, I updated the "#ifdef foo" occurrences but forgot to search for "#ifndef foo". :(	Jean-Yves Lefort <jylefort>
Sat 09 Jun 2007 02:51:52 PM UTC, comment #1: This is probably partly because some code uses "#ifndef WITH_SSL" when config.h has "#define WITH_SSL 0".	Anonymous
Sat 09 Jun 2007 01:09:48 PM UTC, original submission: I noticed that the Debian package, which is compiled without SSL, silently falls back to unencrypted connections when the user has configured an account to use SSL/TLS. Mail Notification should not silently use an unencrypted connection, and it should be clear in the user interface when SSL/TLS is unavailable. Originally reported at http://bugs.debian.org/428157 but I then realised upstream is a better place.	Anonymous

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files

file #12991: mail-notif-ssl.patch added by None (4KiB - text/x-patch - This should do the trick)

Depends on the following items: None found

Items that depend on this one: None found

Carbon-Copy List

-email is unavailable- added by tedp (Posted a comment)

-email is unavailable- added by jylefort (Posted a comment)

Follow 5 latest changes.

Date	Changed by	Updated Field	Previous Value	Replaced by
2007-06-26	jylefort	Status	Confirmed	Fixed
		Open/Closed	Open	Closed
2007-06-09	tedp	Carbon-Copy	-	Added tedp
2007-06-09	jylefort	Status	None	Confirmed
2007-06-09	None	Attached File	-	Added mail-notif-ssl.patch, #12991

Mail Notification, A mail notification for freedesktop.org-compliant system trays - Bugs: bug #20131, Sends passwords in cleartext when...

bug #20131: Sends passwords in cleartext when SSL is unavailable

<a href="#discussion">Discussion</a>

<a href="#attached">Attached Files</a>

<a href="#dependencies">Dependencies</a>

<a href="#cc">Mail Notification Carbon-Copy List</a>

<a href="#history">History</a>