bugMail Notification, A mail notification for freedesktop.org-compliant system trays - Bugs: bug #20131, Sends passwords in cleartext when...


You are not allowed to post comments on this tracker with your current authentication level.

bug #20131: Sends passwords in cleartext when SSL is unavailable

Submitter:  None
Submitted:  Sat 09 Jun 2007 01:09:48 PM UTC
Severity:  6 - Security Status:  Fixed
Privacy:  Public Assigned to:  None
Originator Name:  Originator Email:  -email is unavailable-
Open/Closed:  Closed

Jump to the original submission

Tue 26 Jun 2007 12:38:21 PM UTC, comment #7: 

Fixed in 4.1

Jean-Yves Lefort <jylefort>
Group administrator
Sun 17 Jun 2007 07:08:45 AM UTC, comment #6: 

Yes, I am. I submitted the bug report in Debian and here. I also notified the Debian security team after things were quiet for a couple of days, who I presume passed on the information to the wider community leading the the assignment of the CVE entry.

Ted Percival <tedp>
Sun 17 Jun 2007 06:06:13 AM UTC, comment #5: 

Ted are you the original submitter?

Jean-Yves Lefort <jylefort>
Group administrator
Sun 17 Jun 2007 04:03:35 AM UTC, comment #4: 

My testing indicates this problem is also in version 3.0, but not in 1.1 and 2.0.

Ted Percival <tedp>
Sat 16 Jun 2007 05:02:45 PM UTC, comment #3: 

This is being tracked as CVE-2007-3209:

Ted Percival <tedp>
Sat 09 Jun 2007 04:00:26 PM UTC, comment #2: 

Good catch, thanks. After changing the cpp symbols to 0/1, I updated the "#ifdef foo" occurrences but forgot to search for "#ifndef foo". :(

Jean-Yves Lefort <jylefort>
Group administrator
Sat 09 Jun 2007 02:51:52 PM UTC, comment #1: 

This is probably partly because some code uses "#ifndef WITH_SSL" when config.h has "#define WITH_SSL 0".

Sat 09 Jun 2007 01:09:48 PM UTC, original submission:  

I noticed that the Debian package, which is compiled without SSL, silently falls back to unencrypted connections when the user has configured an account to use SSL/TLS. Mail Notification should not silently use an unencrypted connection, and it should be clear in the user interface when SSL/TLS is unavailable.

Originally reported at http://bugs.debian.org/428157 but I then realised upstream is a better place.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #12991:  mail-notif-ssl.patch added by None (4KiB - text/x-patch - This should do the trick)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by tedp (Posted a comment)
  • -email is unavailable- added by jylefort (Posted a comment)

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2007-06-26 jylefort StatusConfirmed Fixed
        Open/ClosedOpen Closed
    2007-06-09 tedp Carbon-Copy- Added tedp
    2007-06-09 jylefort StatusNone Confirmed
    2007-06-09 None Attached File- Added mail-notif-ssl.patch, #12991

    Back to the top

    Powered by Savane 3.13-f762.
    Corresponding source code