Improper input validation in Mutt

CVE-2011-1429

Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerabilit…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.002 (48.0th percentile) — read the EPSS interpretation.

Affected products

Mutt
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

RHSA-2011:0959 (x_refsource_REDHAT, vendor-advisory)
44937 (x_refsource_SECUNIA, third-party-advisory)
8143 (x_refsource_SREASON, third-party-advisory)
mutt-smtptls-weak-security(66015) (vdb-entry, x_refsource_XF)
20110308 Mutt: failure to check server certificate in SMTP TLS connection (mailing-list, x_refsource_FULLDISC, Patch)
FEDORA-2011-7751 (x_refsource_FEDORA, vendor-advisory)
FEDORA-2011-7739 (x_refsource_FEDORA, vendor-advisory)
FEDORA-2011-7756 (x_refsource_FEDORA, vendor-advisory)
46803 (vdb-entry, x_refsource_BID)