Mail Notification, A mail notification for freedesktop.org-compliant system trays - Bugs: bug #20131, Sends passwords in cleartext when...
You are not allowed to post comments on this tracker with your current authentication level.
bug #20131: Sends passwords in cleartext when SSL is unavailable
Submitter: | None | ||
Submitted: | Sat 09 Jun 2007 01:09:48 PM UTC | ||
Severity: | 6 - Security | Status: | Fixed |
Privacy: | Public | Assigned to: | None |
Originator Name: | Originator Email: | -email is unavailable- | |
Open/Closed: | Closed |
Jump to the original submission
Tue 26 Jun 2007 12:38:21 PM UTC, comment #7: |
Jean-Yves Lefort <jylefort> |
Sun 17 Jun 2007 07:08:45 AM UTC, comment #6: Yes, I am. I submitted the bug report in Debian and here. I also notified the Debian security team after things were quiet for a couple of days, who I presume passed on the information to the wider community leading the the assignment of the CVE entry. |
Ted Percival <tedp> |
Sun 17 Jun 2007 06:06:13 AM UTC, comment #5: Ted are you the original submitter? |
Jean-Yves Lefort <jylefort> |
Sun 17 Jun 2007 04:03:35 AM UTC, comment #4: My testing indicates this problem is also in version 3.0, but not in 1.1 and 2.0. |
Ted Percival <tedp> |
Sat 16 Jun 2007 05:02:45 PM UTC, comment #3: This is being tracked as CVE-2007-3209:
|
Ted Percival <tedp> |
Sat 09 Jun 2007 04:00:26 PM UTC, comment #2: Good catch, thanks. After changing the cpp symbols to 0/1, I updated the "#ifdef foo" occurrences but forgot to search for "#ifndef foo". :( |
Jean-Yves Lefort <jylefort> |
Sat 09 Jun 2007 02:51:52 PM UTC, comment #1: This is probably partly because some code uses "#ifndef WITH_SSL" when config.h has "#define WITH_SSL 0". |
Anonymous |
Sat 09 Jun 2007 01:09:48 PM UTC, original submission:
I noticed that the Debian package, which is compiled without SSL, silently falls back to unencrypted connections when the user has configured an account to use SSL/TLS. Mail Notification should not silently use an unencrypted connection, and it should be clear in the user interface when SSL/TLS is unavailable.
|
Anonymous |
Depends on the following items: None found
Items that depend on this one: None found
Follow 5 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2007-06-26 | jylefort | Status | Confirmed | Fixed | |
Open/Closed | Open | Closed | |||
2007-06-09 | tedp | Carbon-Copy | - | Added tedp | |
2007-06-09 | jylefort | Status | None | Confirmed | |
2007-06-09 | None | Attached File | - | Added mail-notif-ssl.patch, #12991 |
Powered by Savane 3.13-758e.
Corresponding source code
Fixed in 4.1